8384 matches found
Security update for qemu (important)
This update for qemu to version 2.9.1 fixes several issues. It also announces that the qed storage format will be no longer supported in Leap 15.0. These security issues were fixed: - CVE-2017-15268: Qemu allowed remote attackers to cause a memory leak by triggering slow data-channel read...
Security update for xen (important)
This update for xen fixes several issues: These security issues were fixed: - CVE-2017-5526: The ES1370 audio device emulation support was vulnerable to a memory leakage issue allowing a privileged user inside the guest to cause a DoS and/or potentially crash the Qemu process on the host bsc10597...
Security update for the Linux Kernel (important)
The openSUSE Leap 42.2 kernel was updated to 4.4.92 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-13080: Wi-Fi Protected Access WPA and WPA2 allowed reinstallation of the Group Temporal Key GTK during the group key handshake, allowing an attacker...
Security update for chromium (important)
This update to Chromium 62.0.3202.75 fixes the following security issues: - CVE-2017-5124: UXSS with MHTML - CVE-2017-5125: Heap overflow in Skia - CVE-2017-5126: Use after free in PDFium - CVE-2017-5127: Use after free in PDFium - CVE-2017-5128: Heap overflow in WebGL - CVE-2017-5129: Use after...
Security update for hostapd (important)
This update for hostapd fixes the following issues: - Fix KRACK attacks on the AP side boo1063479, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088: Hostap was updated to upstream release 2.6 fixed EAP-pwd last fragment validation...
Security update for openvpn (important)
This update for openvpn fixes the following issues: - CVE-2017-12166: Lack of bound check in readkey in old legacy key handling before using values could be used for a remote buffer overflow bsc1060877. This update was imported from the SUSE:SLE-12:Update update project...
Security update for wget (important)
This update for wget fixes the following security issues: - CVE-2017-13089,CVE-2017-13090: Missing checks for negative remainingchunksize in skipshortbody and fdreadbody could cause stack buffer overflows, which could have been exploited by malicious servers. bsc1064715,bsc1064716 This update was...
Security update for mysql-community-server (important)
This update for mysql-community-server to 5.6.38 fixes the following issues: Full list of changes: http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-38.html CVEs fixed: - boo1064116 CVE-2017-10379 - boo1064117 CVE-2017-10384 - boo1064115 CVE-2017-10378 - boo1064101 CVE-2017-10268 - boo10640...
Security update for the Linux Kernel (important)
The openSUSE Leap 42.3 kernel was updated to 4.4.92 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-13080: Wi-Fi Protected Access WPA and WPA2 allowed reinstallation of the Group Temporal Key GTK during the group key handshake, allowing an attacker...
Security update for xen (important)
This update for xen fixes several issues: These security issues were fixed: - CVE-2017-5526: The ES1370 audio device emulation support was vulnerable to a memory leakage issue allowing a privileged user inside the guest to cause a DoS and/or potentially crash the Qemu process on the host bsc10597...
Security update for git (important)
This update for git fixes the following issues: This security issue was fixed: - CVE-2017-14867: Git used unsafe Perl scripts to support subcommands such as cvsserver, which allowed attackers to execute arbitrary OS commands via shell metacharacters in a module name bsc1061041. This update was...
Security update for wpa_supplicant (important)
This update for wpasupplicant fixes the security issues: - Several vulnerabilities in standard conforming implementations of the WPA2 protocol have been discovered and published under the code name KRACK. This update remedies those issues in a backwards compatible manner, i.e. the updated...
Security update for the Linux Kernel (important)
The openSUSE Leap 42.3 kernel was updated to 4.4.90 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000252: The KVM subsystem in the Linux kernel allowed guest OS users to cause a denial of service assertion failure, and hypervisor hang or crash via a...
Security update for the Linux Kernel (important)
The openSUSE Leap 42.2 Kernel was updated to 4.4.90 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000252: The KVM subsystem in the Linux kernel allowed guest OS users to cause a denial of service assertion failure, and hypervisor hang or crash via a...
Security update for MozillaThunderbird (important)
Mozilla Thunderbird was updated to 52.4.0 boo1060445 new behavior was introduced for replies to mailing list posts: "When replying to a mailing list, reply will be sent to address in From header ignoring Reply-to header". A new preference mail.overridelistreplyto allows to restore the previous...
Security update for MozillaThunderbird (important)
Mozilla Thunderbird was updated to 52.4.0 boo1060445 new behavior was introduced for replies to mailing list posts: "When replying to a mailing list, reply will be sent to address in From header ignoring Reply-to header". A new preference mail.overridelistreplyto allows to restore the previous...
Security update for dnsmasq (important)
This update for dnsmasq fixes the following security issues: - CVE-2017-14491: 2 byte heap based overflow. bsc1060354 - CVE-2017-14492: heap based overflow. bsc1060355 - CVE-2017-14493: stack based overflow. bsc1060360 - CVE-2017-14494: DHCP - info leak. bsc1060361 - CVE-2017-14495: DNS - OOM DoS...
Security update for Mozilla Firefox and NSS (important)
This update to Mozilla Firefox 52.4esr, along with Mozilla NSS 3.28.6, fixes security issues and bugs. The following vulnerabilities advised upstream under MFSA 2017-22 boo1060445 were fixed: - CVE-2017-7793: Use-after-free with Fetch API - CVE-2017-7818: Use-after-free during ARIA array...
Security update for spice (important)
This update for spice fixes the following security issues: - CVE-2017-7506: Fixed an out-of-bounds memory access when processing specially crafted messages from authenticated attacker to the spice server resulting into crash and/or server memory leak bsc1046779. This update was imported from the...
Security update for openjpeg2 (important)
This update for openjpeg2 fixes the following issues: CVE-2016-9114: NULL Pointer Access in function imagetopnm of convert.c:1943jp2 could lead to crash bsc1007740 CVE-2016-9115: Heap Buffer Overflow in function imagetotga of convert.cjp2 bsc1007741 CVE-2016-9580, CVE-2016-9581: Possible Heap...
Security update for xen (important)
This update for xen fixes several issues. These security issues were fixed: - CVE-2017-14316: Missing bound check in function allocheappages for an internal array allowed attackers using crafted hypercalls to execute arbitrary code within Xen XSA-231, bsc1056278 - CVE-2017-14318: The function...
Security update for emacs (important)
This update for emacs fixes one issues. This security issue was fixed: - CVE-2017-14482: Remote code execution via mails with "Content-Type: text/enriched" bsc1058425 This update was imported from the SUSE:SLE-12:Update update project...
Security update for xen (important)
This update for xen fixes several issues. These security issues were fixed: - CVE-2017-14316: Missing bound check in function allocheappages for an internal array allowed attackers using crafted hypercalls to execute arbitrary code within Xen XSA-231, bsc1056278 - CVE-2017-14318: The function...
Security update for qemu (important)
This update for qemu fixes the following issues: Security issues fixed: CVE-2017-10664: Fix DOS vulnerability in qemu-nbd bsc1046636 CVE-2017-10806: Fix DOS from stack overflow in debug messages of usb redirection support bsc1047674 CVE-2017-11334: Fix OOB access during DMA operation bsc1048902...
Security update for ffmpeg, ffmpeg2 (important)
This update introduces lame and twolame. For ffmpeg2 it updates to version 2.8.13 and fixes several issues. These security issues were fixed: - CVE-2017-14058: The readdata function in libavformat/hls.c did not restrict reload attempts for an insufficient list, which allowed remote attackers to...
Security update for the Linux Kernel (important)
The openSUSE Leap 42.2 kernel was updated to 4.4.87 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000251: The native Bluetooth stack in the Linux Kernel BlueZ was vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration...
Security update for the Linux Kernel (important)
The openSUSE Leap 42.3 kernel was updated to 4.4.87 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000251: The native Bluetooth stack in the Linux Kernel BlueZ was vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration...
Security update for chromium (important)
This update for chromium to version 61.0.3163.79 fixes several issues. These security issues were fixed: - CVE-2017-5111: Use after free in PDFium boo1057364. - CVE-2017-5112: Heap buffer overflow in WebGL boo1057364. - CVE-2017-5113: Heap buffer overflow in Skia boo1057364. - CVE-2017-5114: Memo...
Security update for chromium (important)
This update for chromium to version 61.0.3163.79 fixes several issues. These security issues were fixed: - CVE-2017-5111: Use after free in PDFium boo1057364. - CVE-2017-5112: Heap buffer overflow in WebGL boo1057364. - CVE-2017-5113: Heap buffer overflow in Skia boo1057364. - CVE-2017-5114: Memo...
Security update for xen (important)
This update for xen to version 4.7.3 fixes several issues. These security issues were fixed: - CVE-2017-12135: Unbounded recursion in grant table code allowed a malicious guest to crash the host or potentially escalate privileges/leak information XSA-226, bsc1051787. - CVE-2017-12137:...
Security update for xen (important)
This update for xen fixes several issues. These security issues were fixed: - CVE-2017-12135: Unbounded recursion in grant table code allowed a malicious guest to crash the host or potentially escalate privileges/leak information XSA-226, bsc1051787. - CVE-2017-12137: Incorrectly-aligned updates ...
Security update for gdk-pixbuf (important)
This update for gdk-pixbuf fixes the following issues: - CVE-2017-2862: JPEG gdkpixbufjpegimageloadincrement Code Execution Vulnerability bsc1048289 - CVE-2017-2870: tiffimageparse Code Execution Vulnerability bsc1048544 - CVE-2017-6313: A dangerous integer underflow in io-icns.c bsc1027024 -...
Security update for postgresql94 (important)
This update for postgresql94 fixes the following issues: CVE-2017-7547: Further restrict visibility of pgusermappings.umoptions, to protect passwords stored as user mapping options. bsc1051685 CVE-2017-7546: Disallow empty passwords in all password-based authentication methods. bsc1051684...
Security update for postgresql96 (important)
This update for postgresql96 fixes the following issues: CVE-2017-7547: Further restrict visibility of pgusermappings.umoptions, to protect passwords stored as user mapping options. bsc1051685 CVE-2017-7546: Disallow empty passwords in all password-based authentication methods. bsc1051684...
Security update for the Linux Kernel (important)
The openSUSE Leap 42.3 kernel was updated to 4.4.85 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-14051: An integer overflow in the qla2x00sysfswriteoptromctl function in drivers/scsi/qla2xxx/qlaattr.c in the Linux kernel allowed local users to cause...
Security update for libzypp, zypper (important)
The Software Update Stack was updated to receive fixes and enhancements. libzypp: - Adapt to work with GnuPG 2.1.23. bsc1054088 - Support signing with subkeys. bsc1008325 - Enhance sort order for media.1/products. bsc1054671 zypper: - Also show a gpg key's subkeys. bsc1008325 - Improve signature...
Security update for php7 (important)
This update for php7 fixes the following issues: - CVE-2016-10397: parseurl can be bypassed to return fake host. bsc1047454 - CVE-2017-11142: Remoteattackers could cause a CPU consumption denial of service attack by injectinglong form variables, related to main/phpvariables. bsc1048100 -...
Security update for libzypp (important)
The Software Update Stack was updated to receive fixes and enhancements. libzypp: - CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG check workflows, mainly for unsigned repositories and packages. bsc1045735, bsc1038984 - Fix gpg-pubkey release creation time computation. bsc1036659 - Update...
Security update for freerdp (important)
This update for freerdp fixes the following issues: - CVE-2017-2834: Out-of-bounds write in licenserecv bsc1050714 - CVE-2017-2835: Out-of-bounds write in rdprecvtpktpdu bsc1050712 - CVE-2017-2836: Rdp Client Read Server Proprietary Certificate Denial of Service bsc1050699 - CVE-2017-2837: Client...
Security update for git (important)
This update for git fixes the following issues: - CVE-2017-1000117: A client side code execution via shell injection when receiving special submodule strings from a malicious server was fixed bsc1052481 This update was imported from the SUSE:SLE-12:Update update project...
Security update for samba and resource-agents (important)
This update provides Samba 4.6.7, which fixes the following issues: - CVE-2017-11103: Metadata were being taken from the unauthenticated plaintext the Ticket rather than the authenticated and encrypted KDC response. bsc1048278 - Fix cephwrapchdir. bsc1048790 - Fix ctdb logs to /var/log/log.ctdb...
Security update for postgresql93 (important)
Postgresql93 was updated to 9.3.18 to fix the following issues: CVE-2017-7547: Further restrict visibility of pgusermappings.umoptions, to protect passwords stored as user mapping options. bsc1051685 CVE-2017-7546: Disallow empty passwords in all password-based authentication methods. bsc1051684...
Security update for exim (important)
This update for exim fixes the following issues: Changes in exim: - specify users with ref:mail, to make them dynamic. boo1046971 - CVE-2017-1000369: Fixed memory leaks that could be exploited to "stack crash" local privilege escalation boo1044692 - Require usermail groupmail to meet new users...
Security update for ImageMagick (important)
This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2017-9439: A memory leak was found in the function ReadPDBImage incoders/pdb.c bsc1042826 - CVE-2017-9440: A memory leak was found in the function ReadPSDChannelin coders/psd.c bsc1042812 - CVE-2017-9501: An...
Security update for freeradius-server (important)
This update for freeradius-server fixes the following issues: - update to 3.0.15 bsc1049086 Bind the lifetime of program name and python path to the module CVE-2017-10978: FR-GV-201: Check input / output length in makesecret bsc1049086 CVE-2017-10983: FR-GV-206: Fix read overflow when decoding DH...
Security update for MozillaThunderbird (important)
This update for MozillaThunderbird to version 52.3 fixes security issues and bugs. The following vulnerabilities were fixed: - CVE-2017-7798: XUL injection in the style editor in devtools - CVE-2017-7800: Use-after-free in WebSockets during disconnection - CVE-2017-7801: Use-after-free with marqu...
Security update for openjpeg2 (important)
This update for openjpeg2 fixes the following issues: - CVE 2016-7163: Integer Overflow could lead to remote code execution bsc997857 - CVE 2015-8871: Use-after-free in opjj2kwritemco function could lead to denial of service bsc979907 This update was imported from the SUSE:SLE-12-SP2:Update updat...
Security update for subversion (important)
This update for subversion to 1.9.7 fixes security issues and bugs. The following vulnerabilities were fixed: - CVE-2017-9800: A remote attacker could have caused svn clients to execute arbitrary code via specially crafted URLs in svn:externals and svn:sync-from-url properties. boo1051362 -...
Security update for git (important)
This update for git fixes the following security issues: - CVE-2017-1000117: A malicious third-party could have caused a git client to execute arbitrary commands via crafted "ssh://..." URLs, including submodules boo1052481...
Security update for the Linux Kernel (important)
The openSUSE Leap 42.3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000111: Fixed a race condition in net-packet code that could be exploited to cause out-of-bounds memory access bsc1052365. - CVE-2017-1000112: Fixed a race...