Security update for redis (important)

This update for redis to 4.0.10 fixes the following issues: These security issues were fixed: - CVE-2018-11218: Prevent heap corruption vulnerability in cmsgpack bsc1097430. - CVE-2018-11219: Prevent integer overflow in Lua scripting bsc1097768. For Leap 42.3 and openSUSE SLE 12 backports this is...

Security update for mariadb (important)

This update for MariaDB to version 10.0.35 fixes multiple issues: Security issues fixed: CVE-2018-2782: Unspecified DoS vulnerability in InnoDB bsc1090518 CVE-2018-2784: Unspecified DoS vulnerability in InnoDB bsc1090518 CVE-2018-2787: Unspecified vulnerability in InnoDB allowing writes bsc109051...

Security update for redis (important)

This update for redis to 4.0.10 fixes the following issues: These security issues were fixed: - CVE-2018-11218: Prevent heap corruption vulnerability in cmsgpack bsc1097430. - CVE-2018-11219: Prevent integer overflow in Lua scripting bsc1097768. For Leap 42.3 and openSUSE SLE 12 backports this is...

Security update for the Linux Kernel (important)

The openSUSE Leap 42.3 was updated to 4.4.138 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-3639: Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes a...

Security update for cobbler (moderate)

This update for cobbler fixes the following issues: The following security issue has been fixed: - CVE-2017-1000469: Escape shell parameters provided by the user for the reposync action. bsc1074594 Additionally, the following non-security issues have been fixed: - Fix signature for SLES15...

Security update for matrix-synapse (moderate)

This update for matrix-synapse fixes the following security issue: - CVE-2018-12291: visibility rules were not applied correctly in the getmissingevents federation API boo1096833...

opensuse-security@xxxxxxxxxxxx</li> <li><span class="identifier"> Date</span>: Tue, 19 Jun 2018 12:08:11 +0200 (CEST)</li> <li><span class="identifier"> Message-id</span>: &lt;<a href="msg00037.html">[email protected]</a>&gt;</li> </ul> <!--X-Head-of-Message-End--> <!--X-Head-Body-Sep-Begin--> </div> <div class="body"> <!--X-Head-Body-Sep-End--> <!--X-Body-of-Message--> openSUSE Security Update: Security update for aubio<br> ______________________________________________________________________________<br> <br> Announcement ID: openSUSE-SU-2018:1734-1<br> Rating: low<br> References: #1072317 <br> Cross-References: CVE-2017-17554<br> Affected Products:<br> openSUSE Leap 15.0<br> ______________________________________________________________________________<br> <br> An update that fixes one vulnerability is now available.<br> <br> Description:<br> <br> This update for aubio fixes the following security issue:<br> <br> - CVE-2017-17554: Prevent NULL pointer dereference in the function<br> aubio_source_avcodec_readframe which may have lead to DoS when playing a<br> crafted audio file (bsc#1072317).<br> <br> <br> Patch Instructions:<br> <br> To install this openSUSE Security Update use the SUSE recommended <br> installation methods<br> like YaST online_update or &quot;zypper patch&quot;.<br> <br> Alternatively you can run the command listed for your product:<br> <br> - openSUSE Leap 15.0:<br> <br> zypper in -t patch openSUSE-2018-652=1<br> <br> <br> <br> Package List:<br> <br> - openSUSE Leap 15.0 (i586 x86_64):<br> <br> aubio-debugsource-0.4.6-lp150.3.3.1<br> aubio-tools-0.4.6-lp150.3.3.1<br> aubio-tools-debuginfo-0.4.6-lp150.3.3.1<br> libaubio-devel-0.4.6-lp150.3.3.1<br> libaubio5-0.4.6-lp150.3.3.1<br> libaubio5-debuginfo-0.4.6-lp150.3.3.1<br> <br> - openSUSE Leap 15.0 (x86_64):<br> <br> libaubio5-32bit-0.4.6-lp150.3.3.1<br> libaubio5-32bit-debuginfo-0.4.6-lp150.3.3.1<br> python-aubio-debugsource-0.4.6-lp150.3.3.1<br> python2-aubio-0.4.6-lp150.3.3.1<br> python2-aubio-debuginfo-0.4.6-lp150.3.3.1<br> python3-aubio-0.4.6-lp150.3.3.1<br> python3-aubio-debuginfo-0.4.6-lp150.3.3.1<br> <br> <br> References:<br> <br> <a rel="nofollow" href="https://www.suse.com/security/cve/CVE-2017-17554.html">https://www.suse.com/security/cve/CVE-2017-17554.html</a><br> <a rel="nofollow" href="https://bugzilla.suse.com/1072317">https://bugzilla.suse.com/1072317</a><br> <br> -- <br> To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@xxxxxxxxxxxx<br> For additional commands, e-mail: opensuse-security-announce+help@xxxxxxxxxxxx<br> <br> <!--X-Body-of-Message-End--> <!--X-MsgBody-End--> <!--X-Follow-Ups--> <!-- SwishCommand noindex --> </div> <table class="bodynav"> <tr> <td align="left"> &lt; Previous </td> <td align="right"> Next &gt; </td> </tr> </table> </div> <div class="visualClear"></div> </div> </div> </div> <div id="column-one"> <a name="indexes"></a> <div class="portlet" id="p-topnav"> <div class="pBody"> <ul> <li><a href="threads.html">Thread Index</a></li> <li><a href="author.html">Author Index</a></li> <li><a href="date.html">Date Index</a></li> <li><a href="all.html">All Messages</a></li> </ul> </div> </div> <div class="portlet" id="p-logo"> <a style="background-image: url(/skins/opensuse/opensuse.gif);" href="../" title="Back"></a> </div> <script type="text/javascript"> if (window.isMSIE55) fixalpha(); </script> <a name="search"></a> <div id="p-search" class="portlet" style="white-space: nowrap;"> <h5><label for="searchInput">Search this list</label> (Security update for aubio</h5> <!--X-Subject-Header-End--> <!--X-Head-of-Message--> <ul> <li><span class="identifier"> From</span>)

This update for aubio fixes the following security issue: - CVE-2017-17554: Prevent NULL pointer dereference in the function aubiosourceavcodecreadframe which may have lead to DoS when playing a crafted audio file bsc1072317...

opensuse-security@xxxxxxxxxxxx</li> <li><span class="identifier"> Date</span>: Tue, 19 Jun 2018 12:07:49 +0200 (CEST)</li> <li><span class="identifier"> Message-id</span>: &lt;<a href="msg00036.html">[email protected]</a>&gt;</li> </ul> <!--X-Head-of-Message-End--> <!--X-Head-Body-Sep-Begin--> </div> <div class="body"> <!--X-Head-Body-Sep-End--> <!--X-Body-of-Message--> openSUSE Security Update: Security update for aubio<br> ______________________________________________________________________________<br> <br> Announcement ID: openSUSE-SU-2018:1733-1<br> Rating: low<br> References: #1072317 <br> Cross-References: CVE-2017-17554<br> Affected Products:<br> openSUSE Leap 42.3<br> ______________________________________________________________________________<br> <br> An update that fixes one vulnerability is now available.<br> <br> Description:<br> <br> This update for aubio fixes the following security issue:<br> <br> - CVE-2017-17554: Prevent NULL pointer dereference in the function<br> aubio_source_avcodec_readframe which may have lead to DoS when playing a<br> crafted audio file (bsc#1072317).<br> <br> <br> Patch Instructions:<br> <br> To install this openSUSE Security Update use the SUSE recommended <br> installation methods<br> like YaST online_update or &quot;zypper patch&quot;.<br> <br> Alternatively you can run the command listed for your product:<br> <br> - openSUSE Leap 42.3:<br> <br> zypper in -t patch openSUSE-2018-651=1<br> <br> <br> <br> Package List:<br> <br> - openSUSE Leap 42.3 (i586 x86_64):<br> <br> aubio-debugsource-0.4.1-9.6.2<br> aubio-tools-0.4.1-9.6.2<br> aubio-tools-debuginfo-0.4.1-9.6.2<br> libaubio-devel-0.4.1-9.6.2<br> libaubio4-0.4.1-9.6.2<br> libaubio4-debuginfo-0.4.1-9.6.2<br> <br> - openSUSE Leap 42.3 (x86_64):<br> <br> libaubio4-32bit-0.4.1-9.6.2<br> libaubio4-debuginfo-32bit-0.4.1-9.6.2<br> <br> <br> References:<br> <br> <a rel="nofollow" href="https://www.suse.com/security/cve/CVE-2017-17554.html">https://www.suse.com/security/cve/CVE-2017-17554.html</a><br> <a rel="nofollow" href="https://bugzilla.suse.com/1072317">https://bugzilla.suse.com/1072317</a><br> <br> -- <br> To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@xxxxxxxxxxxx<br> For additional commands, e-mail: opensuse-security-announce+help@xxxxxxxxxxxx<br> <br> <!--X-Body-of-Message-End--> <!--X-MsgBody-End--> <!--X-Follow-Ups--> <!-- SwishCommand noindex --> </div> <table class="bodynav"> <tr> <td align="left"> &lt; Previous </td> <td align="right"> Next &gt; </td> </tr> </table> </div> <div class="visualClear"></div> </div> </div> </div> <div id="column-one"> <a name="indexes"></a> <div class="portlet" id="p-topnav"> <div class="pBody"> <ul> <li><a href="threads.html">Thread Index</a></li> <li><a href="author.html">Author Index</a></li> <li><a href="date.html">Date Index</a></li> <li><a href="all.html">All Messages</a></li> </ul> </div> </div> <div class="portlet" id="p-logo"> <a style="background-image: url(/skins/opensuse/opensuse.gif);" href="../" title="Back"></a> </div> <script type="text/javascript"> if (window.isMSIE55) fixalpha(); </script> <a name="search"></a> <div id="p-search" class="portlet" style="white-space: nowrap;"> <h5><label for="searchInput">Search this list</label> (Security update for aubio</h5> <!--X-Subject-Header-End--> <!--X-Head-of-Message--> <ul> <li><span class="identifier"> From</span>)

This update for aubio fixes the following security issue: - CVE-2017-17554: Prevent NULL pointer dereference in the function aubiosourceavcodecreadframe which may have lead to DoS when playing a crafted audio file bsc1072317...

Security update for samba (moderate)

Samba was updated to 4.6.14, fixing bugs and security issues: Version update to 4.6.14 bsc1093664: + vfsceph: add fake async pwrite/pread send/recv hooks; bso13425. + Fix memory leak in vfsceph; bso13424. + winbind: avoid using fstrcpydcname,... in dualinitconnection; bso13294. + s3:smb2server:...

Security update for gpg2 (important)

This update for gpg2 fixes the following security issue: - CVE-2018-12020: GnuPG mishandled the original filename during decryption and verification actions, which allowed remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2"...

Security update for python-python-gnupg (moderate)

This update for python-python-gnupg to version 0.4.3 fixes the following issues: The following security vulnerabilities were addressed: - Sanitize diagnostic output of the original file name in verbose mode CVE-2018-12020 boo1096745 The following other changes were made: - Add --no-verbose to the...

Security update for poppler (moderate)

This update for poppler fixes the following issues: These security issues were fixed: - CVE-2017-14517: Prevent NULL Pointer dereference in the XRef::parseEntry function via a crafted PDF document bsc1059066. - CVE-2017-9865: Fixed a stack-based buffer overflow vulnerability in GfxState.cc that...

Security update for java-1_8_0-openjdk (important)

This update for java-180-openjdk to version 8u171 fixes the following issues: These security issues were fixed: - S8180881: Better packaging of deserialization - S8182362: Update CipherOutputStream Usage - S8183032: Upgrade to LittleCMS 2.9 - S8189123: More consistent classloading - S8189969,...

Security update for java-1_7_0-openjdk (important)

This update for java-170-openjdk to version 7u181 fixes the following issues: + S8162488: JDK should be updated to use LittleCMS 2.8 + S8180881: Better packaging of deserialization + S8182362: Update CipherOutputStream Usage + S8183032: Upgrade to LittleCMS 2.9 + S8189123: More consistent...

Security update for postgresql96 (moderate)

PostgreSQL was updated to 9.6.9 fixing bugs and security issues: Release notes: - https://www.postgresql.org/about/news/1851/ - https://www.postgresql.org/docs/current/static/release-9-6-9.html A dump/restore is not required for those running 9.6.X. However, if you use the adminpack extension, yo...

Security update for enigmail (moderate)

This update for enigmail fixes vulnerabilities that allowed spoofing of e-mail signatures: - CVE-2018-12019: signature spoofing via specially crafted OpenPGP user IDs boo1097525 - CVE-2018-12020: signature spoofing via diagnostic output of the original file name in GnuPG verbose mode boo1096745...

Security update for enigmail (moderate)

This update for enigmail fixes vulnerabilities that allowed spoofing of e-mail signatures: - CVE-2018-12019: signature spoofing via specially crafted OpenPGP user IDs boo1097525 - CVE-2018-12020: signature spoofing via diagnostic output of the original file name in GnuPG verbose mode boo1096745...

Security update for opencv (moderate)

This update for opencv fixes this security issue: - CVE-2017-18009: Prevent heap-based buffer over-read in the function cv::HdrDecoder::checkSignature bsc1074312...

Security update for bouncycastle (moderate)

This update for bouncycastle to version 1.59 fixes the following issues: These security issues were fixed: - CVE-2017-13098: BouncyCastle, when configured to use the JCE Java Cryptography Extension for cryptographic functions, provided a weak Bleichenbacher oracle when any TLS cipher suite using...

opensuse-security@xxxxxxxxxxxx</li> <li><span class="identifier"> Date</span>: Wed, 13 Jun 2018 18:07:57 +0200 (CEST)</li> <li><span class="identifier"> Message-id</span>: &lt;<a href="msg00024.html">[email protected]</a>&gt;</li> </ul> <!--X-Head-of-Message-End--> <!--X-Head-Body-Sep-Begin--> </div> <div class="body"> <!--X-Head-Body-Sep-End--> <!--X-Body-of-Message--> openSUSE Security Update: Security update for taglib<br> ______________________________________________________________________________<br> <br> Announcement ID: openSUSE-SU-2018:1686-1<br> Rating: low<br> References: #1096180 <br> Cross-References: CVE-2018-11439<br> Affected Products:<br> openSUSE Leap 42.3<br> openSUSE Leap 15.0<br> ______________________________________________________________________________<br> <br> An update that fixes one vulnerability is now available.<br> <br> Description:<br> <br> This update for taglib fixes this security issues:<br> <br> - CVE-2018-11439: The TagLib::Ogg::FLAC::File::scan function allowed<br> remote attackers to cause information disclosure (heap-based buffer<br> over-read) via a crafted audio file (bsc#1096180).<br> <br> <br> Patch Instructions:<br> <br> To install this openSUSE Security Update use the SUSE recommended <br> installation methods<br> like YaST online_update or &quot;zypper patch&quot;.<br> <br> Alternatively you can run the command listed for your product:<br> <br> - openSUSE Leap 42.3:<br> <br> zypper in -t patch openSUSE-2018-627=1<br> <br> - openSUSE Leap 15.0:<br> <br> zypper in -t patch openSUSE-2018-627=1<br> <br> <br> <br> Package List:<br> <br> - openSUSE Leap 42.3 (i586 x86_64):<br> <br> libtag-devel-1.11-8.1<br> libtag1-1.11-8.1<br> libtag1-debuginfo-1.11-8.1<br> libtag_c0-1.11-8.1<br> libtag_c0-debuginfo-1.11-8.1<br> taglib-1.11-8.1<br> taglib-debuginfo-1.11-8.1<br> taglib-debugsource-1.11-8.1<br> <br> - openSUSE Leap 42.3 (x86_64):<br> <br> libtag1-32bit-1.11-8.1<br> libtag1-debuginfo-32bit-1.11-8.1<br> libtag_c0-32bit-1.11-8.1<br> libtag_c0-debuginfo-32bit-1.11-8.1<br> <br> - openSUSE Leap 15.0 (i586 x86_64):<br> <br> libtag-devel-1.11.1-lp150.3.3.1<br> libtag1-1.11.1-lp150.3.3.1<br> libtag1-debuginfo-1.11.1-lp150.3.3.1<br> libtag_c0-1.11.1-lp150.3.3.1<br> libtag_c0-debuginfo-1.11.1-lp150.3.3.1<br> taglib-1.11.1-lp150.3.3.1<br> taglib-debuginfo-1.11.1-lp150.3.3.1<br> taglib-debugsource-1.11.1-lp150.3.3.1<br> <br> - openSUSE Leap 15.0 (x86_64):<br> <br> libtag1-32bit-1.11.1-lp150.3.3.1<br> libtag1-32bit-debuginfo-1.11.1-lp150.3.3.1<br> libtag_c0-32bit-1.11.1-lp150.3.3.1<br> libtag_c0-32bit-debuginfo-1.11.1-lp150.3.3.1<br> <br> <br> References:<br> <br> <a rel="nofollow" href="https://www.suse.com/security/cve/CVE-2018-11439.html">https://www.suse.com/security/cve/CVE-2018-11439.html</a><br> <a rel="nofollow" href="https://bugzilla.suse.com/1096180">https://bugzilla.suse.com/1096180</a><br> <br> -- <br> To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@xxxxxxxxxxxx<br> For additional commands, e-mail: opensuse-security-announce+help@xxxxxxxxxxxx<br> <br> <!--X-Body-of-Message-End--> <!--X-MsgBody-End--> <!--X-Follow-Ups--> <!-- SwishCommand noindex --> </div> <table class="bodynav"> <tr> <td align="left"> &lt; Previous </td> <td align="right"> Next &gt; </td> </tr> </table> </div> <div class="visualClear"></div> </div> </div> </div> <div id="column-one"> <a name="indexes"></a> <div class="portlet" id="p-topnav"> <div class="pBody"> <ul> <li><a href="threads.html">Thread Index</a></li> <li><a href="author.html">Author Index</a></li> <li><a href="date.html">Date Index</a></li> <li><a href="all.html">All Messages</a></li> </ul> </div> </div> <div class="portlet" id="p-logo"> <a style="background-image: url(/skins/opensuse/opensuse.gif);" href="../" title="Back"></a> </div> <script type="text/javascript"> if (window.isMSIE55) fixalpha(); </script> <a name="search"></a> <div id="p-search" class="portlet" style="white-space: nowrap;"> <h5><label for="searchInput">Search this list</label> (Security update for taglib</h5> <!--X-Subject-Header-End--> <!--X-Head-of-Message--> <ul> <li><span class="identifier"> From</span>)

This update for taglib fixes this security issues: - CVE-2018-11439: The TagLib::Ogg::FLAC::File::scan function allowed remote attackers to cause information disclosure heap-based buffer over-read via a crafted audio file bsc1096180...

Security update for mupdf (moderate)

This update for mupdf fixes the following security issue: - CVE-2018-1000051: Prevent use after free in fzkeepkeystorable that can result in DOS / possible code execution. This attack appear to be exploitable via Victim opens a specially crafted PDF bsc1080531...

Security update for glibc (moderate)

This update for glibc fixes the following issues: This security issue was fixed: - Fixed an buffer overwrite issue in memcpy for Knights Landing CPUs boo1092877, CVE-2018-11237...

Security update for prosody (moderate)

This update for prosody to version 0.10.2 fixes the following issues: This security issue was fixed: - CVE-2018-10847: Prevent insufficient validation of client-provided parameters during XMPP stream restarts. Authenticated users may have overriden the realm associated with their session,...

Security update for kernel-firmware (moderate)

This update for kernel-firmware fixes the following issues: This security issue was fixed: - CVE-2017-5715: Prevent unauthorized disclosure of information to an attacker with local user access caused by speculative execution and indirect branch prediction bsc1095735 This update was imported from...

Security update for ImageMagick (moderate)

This update for ImageMagick to version 7.0.7-34 fixes the following issues: The following security issue was fixed: - Fixed numerous use of uninitialized values, integer overflow, memory exceeded, and timeouts. The following non-security issues were fixed: - Added support for reading eXIf chunks ...

Security update for qemu (important)

This update for qemu fixes the following issues: This security issue was fixed: - CVE-2018-3639: Spectre v4 vulnerability mitigation support for KVM guests bsc1092885. Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of al...

Security update for prosody (moderate)

This update for prosody fixes the following issues: This security issue was fixed: - CVE-2018-10847: Prevent insufficient validation of client-provided parameters during XMPP stream restarts. Authenticated users may have overriden the realm associated with their session, potentially bypassing...

Security update for slf4j (important)

This update for slf4j fixes the following security issue: - CVE-2018-8088: Remote attackers could have bypassed intended access restrictions via crafted data. Disallow EventData deserialization by default from now on bsc1085970...

Security update for curl (moderate)

This update for curl to version 7.60.0 fixes the following issues: These security issues were fixed: - CVE-2018-1000300: Prevent heap-based buffer overflow when closing down an FTP connection with very long server command replies bsc1092094. - CVE-2018-1000301: Prevent buffer over-read that could...

Security update for xen (important)

This update for xen to version 4.10.1 fixes several issues bsc1027519. These security issues were fixed: - CVE-2018-3639: Prevent attackers with local user access from extracting information via a side-channel analysis, aka Speculative Store Bypass SSB, Variant 4 bsc1092631. -...

Security update for libvorbis (moderate)

This update for libvorbis fixes the following issues: The following security issue was fixed: - Fixed the validation of channels in mapping0forward, which previously allowed remote attackers to cause a denial of service via specially crafted files CVE-2018-10392, bsc1091070 This update was import...

Security update for libvirt (important)

This update for libvirt fixes the following issues: This update fixes the following security issue: - Added support for 'ssbd' and 'virt-ssbd' CPUID feature bits CVE-2018-3639, boo1092885...

Security update for MozillaFirefox, mozilla-nss (important)

This update for MozillaFirefox, mozilla-nss fixes the following issues: Security issue fixed in Mozilla Firefox 60.0.2 ESR: - CVE-2018-6126: Heap buffer overflow rasterizing paths in SVG with Skia MFSA 2018-14, boo1096449 The following bugs were fixed: - In KDE Open with option in download dialog...

Security update for glibc (important)

This update for glibc fixes the following issues: - CVE-2017-18269: Fix SSE2 memmove issue when crossing 2GB boundary bsc1094150 - CVE-2018-11236: Fix overflow in path length computation bsc1094161 - CVE-2018-11237: Don't write beyond buffer destination in mempcpyavx512novzeroupper bsc1094154 Non...

Security update for xdg-utils (important)

This update for xdg-utils fixes this security issues: - CVE-2017-18266: The openenvvar function in xdg-open did not validate strings launching the program specified by the BROWSER environment variable, which might allowed remote attackers to conduct argument-injection attacks via a crafted URL...

Security update for mariadb (moderate)

This update for mariadb to version 10.2.15 fixes the following issues: These security issues were fixed: - CVE-2018-2767: Enforse use of SSL/TLS in embedded server library Return of BACKRONYM bsc1088681. - CVE-2018-2786: Vulnerability in the MySQL Server component of Oracle MySQL subcomponent:...

Security update for zziplib (moderate)

This update for zziplib fixes the following issues: Security issue fixed: - CVE-2018-6542: Reject file if the size of the central directory is too big and display an error message bsc1079094. This update was imported from the SUSE:SLE-12:Update update project...

Security update for ocaml (important)

This update for ocaml fixes the following issues: - CVE-2018-9838: The camlbadeserialize function in byterun/bigarray.c in the standard library had an integer overflow which, in situations where marshalled data is accepted from an untrusted source, allows remote attackers to cause a denial of...

Security update for dpdk-thunderxdpdk (moderate)

This update fixes the following issues: - CVE-2018-1059: The DPDK vhost-user interface did not check to verify that all the requested guest physical range was mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may have lead to a malicious...

Security update for git (important)

This update for fixes the following security issues: path sanity-checks on NTFS can read arbitrary memory CVE-2018-11233, boo1095218 arbitrary code execution when recursively cloning a malicious repository CVE-2018-11235, boo1095219...

Security update for kernel modules (moderate)

This update provides rebuilt kernel modules for openSUSE Leap 42.3 with retpoline enablement to address Spectre Variant 2 CVE-2017-5715 bsc1068032...

Security update for xen (important)

This update for xen fixes the following issues: Security issues fixed: - CVE-2018-3639: Spectre V4 – Speculative Store Bypass aka "Memory Disambiguation" bsc1092631 This feature can be controlled by the "ssbd=on/off" commandline flag for the XEN hypervisor. - CVE-2018-10982: x86 vHPET interrupt...

Security update for chromium (important)

This update for chromium to version 66.0.3359.181 fixes the following issues: The following security issues were fixed boo1095163: CVE-2018-6123: Use after free in Blink. CVE-2018-6124: Type confusion in Blink. CVE-2018-6125: Overly permissive policy in WebUSB. CVE-2018-6126: Heap buffer overflow...

Security update for chromium (important)

This update for chromium to version 66.0.3359.181 fixes the following issues: The following security issues were fixed boo1095163: CVE-2018-6123: Use after free in Blink. CVE-2018-6124: Type confusion in Blink. CVE-2018-6125: Overly permissive policy in WebUSB. CVE-2018-6126: Heap buffer overflow...

Security update for ceph (important)

This update for ceph fixes the following issues: Security issues fixed: - CVE-2018-7262: rgw: malformed http headers can crash rgw bsc1081379. - CVE-2017-16818: User reachable asserts allow for DoS bsc1063014. Bug fixes: - bsc1061461: OSDs keep generating coredumps after adding new OSD node to...

Security update for perl-DBD-mysql (moderate)

This update for perl-DBD-mysql fixes the following issues: - CVE-2017-10789: The DBD::mysql module when with mysqlssl=1 setting enabled, means that SSL is optional even though this setting's documentation has a "your communication with the server will be encrypted" statement, which could lead...

opensuse-security@xxxxxxxxxxxx</li> <li><span class="identifier"> Date</span>: Tue, 29 May 2018 18:07:29 +0200 (CEST)</li> <li><span class="identifier"> Message-id</span>: &lt;<a href="msg00112.html">[email protected]</a>&gt;</li> </ul> <!--X-Head-of-Message-End--> <!--X-Head-Body-Sep-Begin--> </div> <div class="body"> <!--X-Head-Body-Sep-End--> <!--X-Body-of-Message--> openSUSE Security Update: Security update for pdns<br> ______________________________________________________________________________<br> <br> Announcement ID: openSUSE-SU-2018:1462-1<br> Rating: low<br> References: #1092540 <br> Cross-References: CVE-2018-1046<br> Affected Products:<br> SUSE Package Hub for SUSE Linux Enterprise 12<br> ______________________________________________________________________________<br> <br> An update that fixes one vulnerability is now available.<br> <br> Description:<br> <br> <br> pdns was updated to 4.1.2.<br> <br> Security fixes:<br> <br> * Dnsreplay: bail out on a too small outgoing buffer (CVE-2018-1046<br> bsc#1092540)<br> <br> Improvements:<br> <br> * API: increase serial after dnssec related updates<br> * Auth: lower ‘packet too short’ loglevel<br> * Make check-zone error on rows that have content but shouldn’t<br> * Auth: avoid an isane amount of new backend connections during an axfr<br> * Report unparseable data in stoul invalid_argument exception<br> * Backport: recheck serial when axfr is done<br> * Backport: add tcp support for alias<br> <br> Bug Fixes:<br> <br> * Auth: allocate new statements after reconnecting to postgresql<br> * Auth-bindbackend: only compare ips in ismaster() (Kees Monshouwer)<br> * Rather than crash, sheepishly report no file/linenum<br> * Document undocumented config vars<br> * Backport #6276 (auth 4.1.x): prevent cname + other data with dnsupdate<br> <br> Misc fixes:<br> <br> * Move includes around to avoid boost L conflict<br> * Backport: update edns option code list<br> * Auth: link dnspcap2protobuf against librt when needed<br> * Fix a warning on botan &amp;gt;= 2.5.0<br> * Auth 4.1.x: unbreak build<br> <br> <br> Patch Instructions:<br> <br> To install this openSUSE Security Update use the SUSE recommended <br> installation methods<br> like YaST online_update or &quot;zypper patch&quot;.<br> <br> Alternatively you can run the command listed for your product:<br> <br> - SUSE Package Hub for SUSE Linux Enterprise 12:<br> <br> zypper in -t patch openSUSE-2018-538=1<br> <br> <br> <br> Package List:<br> <br> - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x <br> x86_64):<br> <br> pdns-4.1.2-8.1<br> pdns-backend-godbc-4.1.2-8.1<br> pdns-backend-ldap-4.1.2-8.1<br> pdns-backend-lua-4.1.2-8.1<br> pdns-backend-mydns-4.1.2-8.1<br> pdns-backend-mysql-4.1.2-8.1<br> pdns-backend-postgresql-4.1.2-8.1<br> pdns-backend-remote-4.1.2-8.1<br> pdns-backend-sqlite3-4.1.2-8.1<br> <br> <br> References:<br> <br> <a rel="nofollow" href="https://www.suse.com/security/cve/CVE-2018-1046.html">https://www.suse.com/security/cve/CVE-2018-1046.html</a><br> <a rel="nofollow" href="https://bugzilla.suse.com/1092540">https://bugzilla.suse.com/1092540</a><br> <br> -- <br> To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@xxxxxxxxxxxx<br> For additional commands, e-mail: opensuse-security-announce+help@xxxxxxxxxxxx<br> <br> <!--X-Body-of-Message-End--> <!--X-MsgBody-End--> <!--X-Follow-Ups--> <!-- SwishCommand noindex --> </div> <table class="bodynav"> <tr> <td align="left"> &lt; Previous </td> <td align="right"> Next &gt; </td> </tr> </table> </div> <div class="visualClear"></div> </div> </div> </div> <div id="column-one"> <a name="indexes"></a> <div class="portlet" id="p-topnav"> <div class="pBody"> <ul> <li><a href="threads.html">Thread Index</a></li> <li><a href="author.html">Author Index</a></li> <li><a href="date.html">Date Index</a></li> <li><a href="all.html">All Messages</a></li> </ul> </div> </div> <div class="portlet" id="p-logo"> <a style="background-image: url(/skins/opensuse/opensuse.gif);" href="../" title="Back"></a> </div> <script type="text/javascript"> if (window.isMSIE55) fixalpha(); </script> <a name="search"></a> <div id="p-search" class="portlet" style="white-space: nowrap;"> <h5><label for="searchInput">Search this list</label> (Security update for pdns</h5> <!--X-Subject-Header-End--> <!--X-Head-of-Message--> <ul> <li><span class="identifier"> From</span>)

pdns was updated to 4.1.2. Security fixes: Dnsreplay: bail out on a too small outgoing buffer CVE-2018-1046 bsc1092540 Improvements: API: increase serial after dnssec related updates Auth: lower ‘packet too short’ loglevel Make check-zone error on rows that have content but shouldn’t Auth:...

Security update for enigmail (moderate)

This update for enigmail to version 2.0.6 fixes the following issues: Security issues fixed: - Replies to a partially encrypted message may have revealed protected information: no longer display PGP/MIME message part followed by unencrypted data boo1094781 - Signature could be spoofed via...

Security update for enigmail (moderate)

This update for enigmail to version 2.0.6 fixes the following issues: Security issues fixed: - Replies to a partially encrypted message may have revealed protected information: no longer display PGP/MIME message part followed by unencrypted data boo1094781 - Signature could be spoofed via...

Security update for pdns (moderate)

This update for pdns fixes the following issues: Security issues fixed: - CVE-2018-1046: Fix an issue with replaying a specially crafted PCAP file that can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution bsc1092540...