8384 matches found
Security update for the Linux Kernel (important)
The openSUSE Leap 42.2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000111: Fixed a race condition in net-packet code that could be exploited to cause out-of-bounds memory access bsc1052365. - CVE-2017-1000112: Fixed a race...
Security update for tcmu-runner (important)
This update for tcmu-runner fixes the following issues: - qcow handler opens up an information leak via the CheckConfig D-Bus method bsc1049491 - glfs handler allows local DoS via crafted CheckConfig strings bsc1049485 - UnregisterHandler dbus method in tcmu-runner daemon for non-existing handler...
Security update for libsoup (important)
This update for libsoup fixes the following issues: - A bug in the HTTP Chunked Encoding code has been fixed that could have been exploited by attackers to cause a stack-based buffer overflow in client or server code running libsoup bsc1052916, CVE-2017-2885. This update was imported from the...
Security update for MozillaFirefox (important)
This update to Mozilla Firefox 52.3esr fixes a number of security issues. The following vulnerabilities were advised upstream under MFSA 2017-19 boo1052829: - CVE-2017-7798: XUL injection in the style editor in devtools - CVE-2017-7800: Use-after-free in WebSockets during disconnection -...
Security update for mariadb (important)
This MariaDB update to version 10.0.31 GA fixes the following issues: Security issues fixed: - CVE-2017-3308: Subcomponent: Server: DML: Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MariaDB Server. Successful attacks of...
Security update for the Linux Kernel (important)
The openSUSE Leap 42.3 kernel was updated to 4.4.79 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-7542: The ip6find1stfragopt function in net/ipv6/outputcore.c in the Linux kernel allowed local users to cause a denial of service integer overflow and...
Security update for libzypp, zypper (important)
The Software Update Stack was updated to receive fixes and enhancements. libzypp: Security issues fixed: - CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG check workflows, mainly for unsigned repositories and packages. bsc1045735, bsc1038984 Bug fixes: - Re-probe on refresh if the repository...
Security update for the Linux Kernel (important)
The openSUSE Leap 42.2 kernel was updated to 4.4.79 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-7542: The ip6find1stfragopt function in net/ipv6/outputcore.c in the Linux kernel allowed local users to cause a denial of service integer overflow and...
Security update for chromium (important)
This update Chromium to version 60.0.3112.78 fixes security issue and bugs. The following security issues were fixed: CVE-2017-5091: Use after free in IndexedDB CVE-2017-5092: Use after free in PPAPI CVE-2017-5093: UI spoofing in Blink CVE-2017-5094: Type confusion in extensions CVE-2017-5095:...
Security update for chromium (important)
This update Chromium to version 60.0.3112.78 fixes security issue and bugs. The following security issues were fixed: CVE-2017-5091: Use after free in IndexedDB CVE-2017-5092: Use after free in PPAPI CVE-2017-5093: UI spoofing in Blink CVE-2017-5094: Type confusion in extensions CVE-2017-5095:...
Security update for rubygem-puppet (important)
This update for rubygem-puppet fixes the following issues: - CVE-2017-2295: A remote attacker could have forced unsafe YAML deserialization which could have led to code execution bsc1040151...
Security update for evince (important)
This update for evince fixes the following issues: - CVE-2017-1000083: Remote attackers could have used the comicbook mode of evince to inject shell code. bsc1046856, bgo784630 This update was imported from the SUSE:SLE-12-SP2:Update update project...
Security update for xorg-x11-server (important)
This update for xorg-x11-server fixes the following issues: - CVE-2017-10971: Fix endianess handling of GenericEvent to prevent a stack overflow by clients. bnc1035283 - Make sure the type of all events to be sent by ProcXSendExtensionEvent are in the allowed range. - CVE-2017-10972: Initialize t...
Recommended update for ncurses (important)
This update for ncurses fixes the following issues: Security issues fixed: - CVE-2017-10684: Possible RCE via stack-based buffer overflow in the fmtentry function. bsc1046858 - CVE-2017-10685: Possible RCE with format string vulnerability in the fmtentry function. bsc1046853 Bugfixes: - Drop patc...
Security update for qemu (important)
This update for qemu fixes several issues. These security issues were fixed: - CVE-2017-9330: USB OHCI Emulation in qemu allowed local guest OS users to cause a denial of service infinite loop by leveraging an incorrect return value bsc1042159. - CVE-2017-8379: Memory leak in the keyboard input...
Security update for spice (important)
This update for spice fixes the following issues: - CVE-2017-7506: A possible buffer overflow via invalid monitor configurations bsc1046779 This update was imported from the SUSE:SLE-12-SP2:Update update project...
Security update for xen (important)
This update for xen fixes several issues. These security issues were fixed: - CVE-2017-10912: Page transfer might have allowed PV guest to elevate privilege XSA-217, bsc1042882 - CVE-2017-10913 CVE-2017-10914: Races in the grant table unmap code allowed for informations leaks and potentially...
Security update for the Linux Kernel (important)
The openSUSE Leap 42.2 kernel was updated to 4.4.74 to receive various security and bugfixes. This update fixes some long standing btrfs issues. The following security bugs were fixed: - CVE-2017-7518: A KVM debug exception in the syscall handling was fixed which might have been used for local...
Security update for bind (important)
This update for bind fixes the following issues: - An attacker with the ability to send and receive messages to an authoritative DNS server was able to circumvent TSIG authentication of AXFR requests. A server that relied solely on TSIG keys for protection could be manipulated into 1 providing an...
Security update for clamav (important)
This update for clamav fixes the following security issue: - CVE-2012-6706: Fixed an arbitrary memory write in VMSFDELTA filter in libclamunrar bsc1045490 This update was imported from the SUSE:SLE-12:Update update project...
Security update for sudo (important)
This update for sudo fixes the following security issue: - CVE-2017-1000368: A follow-up fix to CVE-2017-1000367, the Linux process name could also contain a newline, which could be used to trick sudo to read/write to an arbitrary open terminal. bsc1042146 Also the following non security bug was...
Security update for the Linux Kernel (important)
The openSUSE Leap 42.2 kernel was updated to 4.4.73 to receive security and bugfixes. The following security bugs were fixed: - CVE-2017-1000364: An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be "jumped"...
Security update for openvpn (important)
This update for openvpn fixes the following issues: - Some parts of the certificate-parsing code did not always clear all allocated memory. This would have allowed clients to leak a few bytes of memory for each connection attempt, thereby facilitating a quite inefficient DoS attack on the server...
Security update for the Linux Kernel (important)
The openSUSE Leap 42.2 kernel was updated to 4.4.72 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000364: An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be...
Security update for glibc (important)
This update for glibc fixes the following issues: - CVE-2017-1000366: Fix a potential privilege escalation vulnerability that allowed unprivileged system users to manipulate the stack of setuid binaries to gain special privileges. bsc1039357 - A bug in glibc that could result in deadlocks between...
Security update for exim (important)
This update for exim fixes the following issues: - CVE-2017-1000369: Fixed a memory leak in exim commandline handling, which could be used to exhaust memory and make "stack crash" attacks likely. boo1044692...
Security update for Mozilla based packages (important)
This update for Mozilla Firefox, Thunderbird, and NSS fixes the following issues: Mozilla Firefox was updated to 52.2esr boo1043960 MFSA 2017-16: CVE-2017-5472 bmo1365602 Use-after-free using destroyed node when regenerating trees CVE-2017-7749 bmo1355039 Use-after-free during docshell reloading...
Security update for mercurial (important)
This update for mercurial fixes the following issues: - CVE-2017-9462: Fix the arbitrary code exec by remote users via "hg serve --stdio" boo1043063...
Security update for the Linux Kernel (important)
The openSUSE Leap 42.2 kernel was updated to 4.4.70 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-9076: The dccpv6requestrecvsock function in net/dccp/ipv6.c in the Linux kernel mishandled inheritance, which allowed local users to cause a denial of...
Security update for java-1_8_0-openjdk (important)
This update for java-180-openjdk fixes the following issues: - Upgrade to version jdk8u131 icedtea 3.4.0 - bsc1034849 Security fixes - S8163520, CVE-2017-3509: Reuse cache entries - S8163528, CVE-2017-3511: Better library loading - S8165626, CVE-2017-3512: Improved window framing - S8167110,...
Security update for chromium (important)
This update to Chromium 59.0.3071.86 fixes the following security issues: - CVE-2017-5070: Type confusion in V8 - CVE-2017-5071: Out of bounds read in V8 - CVE-2017-5072: Address spoofing in Omnibox - CVE-2017-5073: Use after free in print preview - CVE-2017-5074: Use after free in Apps Bluetooth...
Security update for chromium (important)
This update to Chromium 59.0.3071.86 fixes the following security issues: - CVE-2017-5070: Type confusion in V8 - CVE-2017-5071: Out of bounds read in V8 - CVE-2017-5072: Address spoofing in Omnibox - CVE-2017-5073: Use after free in print preview - CVE-2017-5074: Use after free in Apps Bluetooth...
Security update for deluge (important)
This update for deluge fixes two security issues: - CVE-2017-9031: A remote attacker may have used a directory traversal vulnerability in the web interface bsc1039815 - CVE-2017-7178: A remote attacher could have exploited a CSRF vulnerability to trick a logged-in user to perform actions in the...
Security update for mariadb (important)
This update for mariadb fixes the following issues: - update to MariaDB 10.0.30 GA notable changes: XtraDB updated to 5.6.35-80.0 TokuDB updated to 5.6.35-80.0 PCRE updated to 8.40 MDEV-11027: better InnoDB crash recovery progress reporting MDEV-11520: improvements to how InnoDB data files are...
Security update for sudo (important)
This update for sudo fixes the following issues: CVE-2017-1000367: - Due to incorrect assumptions in /proc/pid/stat parsing, a local attacker can pretend that his tty is any file on the filesystem, thus gaining arbitrary file write access on SELinux-enabled systems. bsc1039361 - Fix FQDN for...
Security update for java-1_7_0-openjdk (important)
This update for java-170-openjdk fixes the following issues: - Update to 2.6.10 - OpenJDK 7u141 bsc1034849 Security fixes - S8163520, CVE-2017-3509: Reuse cache entries - S8163528, CVE-2017-3511: Better library loading - S8165626, CVE-2017-3512: Improved window framing - S8167110, CVE-2017-3514:...
Security update for samba (important)
This update for samba fixes the following issue: - An unprivileged user with access to the samba server could cause smbd to load a specially crafted shared library, which then had the ability to execute arbitrary code on the server as 'root'. CVE-2017-7494, bso12780, bsc1038231 This update was...
Security update for rpcbind (important)
This update for rpcbind fixes the following issues: - CVE-2017-8779: A crafted UDP package could lead rcpbind to remote denial-of-service bsc1037559 This update was imported from the SUSE:SLE-12-SP2:Update update project...
Security update for samba (important)
This update for samba fixes the following issue: - An unprivileged user with access to the samba server could cause smbd to load a specially crafted shared library, which then had the ability to execute arbitrary code on the server as 'root'. CVE-2017-7494, bso12780, bsc1038231 This update was...
Security update for libtirpc (important)
This update for libtirpc fixes the following issues: - CVE-2017-8779: crafted UDP packaged could lead rpcbind to denial-of-service bsc1037559 This update was imported from the SUSE:SLE-12-SP2:Update update project...
Security update for smb4k (important)
This update for smb4k fixes the following issues: - Disabled dbus service and polkit rules, because this version of smb4k has a local root exploit issue boo1036245, CVE-2017-8849. Automatic mounting will no longer be possible to work around this security issue...
Security update for tomcat (important)
This update for tomcat fixes the following issues: - CVE-2017-5647 Pipelined requests could lead to information disclosure bsc1033448 - CVE-2017-5648 Untrusted application could retain listener leading to information disclosure bsc1033447 - CVE-2016-8745 shared Processor on Connector code could...
Security update for graphite2 (important)
This update for graphite2 fixes one issue. This security issues was fixed: - CVE-2017-5436: An out-of-bounds write triggered with a maliciously crafted Graphite font could lead to a crash or potentially code execution bsc1035204. This update was imported from the SUSE:SLE-12:Update update project...
Security update for kauth, kdelibs4 (important)
This update for kauth and kdelibs4 fixes the following issues: - CVE-2017-8422: logic flaw in the KAuth framework allowed privilege escalation boo1036244...
Security update for kauth, kdelibs4 (important)
This update for kauth and kdelibs4 fixes the following issues: - CVE-2017-8422: logic flaw in the KAuth framework allowed privilege escalation boo1036244...
Security update for xen (important)
This update for xen fixes several issues. These security issues were fixed: - A malicious 64-bit PV guest may be able to access all of system memory, allowing for all of privilege escalation, host crashes, and information leaks by placing a IRET hypercall in the middle of a multicall batch XSA-21...
Security update for the Linux Kernel (important)
The openSUSE Leap 42.1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-7618: crypto/ahash.c in the Linux kernel allowed attackers to cause a denial of service API operation calling its own callback, and infinite recursion by triggeri...
Security update for mysql-community-server (important)
This update for mysql-community-server to version 5.6.36 fixes the following issues: These security issues were fixed: - CVE-2016-5483: Mysqldump failed to properly quote certain identifiers in SQL statements written to the dump output, allowing for execution of arbitrary commands bsc1029014 -...
Security update for ghostscript (important)
This update for ghostscript fixes the following security vulnerabilities: CVE-2017-8291: A remote command execution and a -dSAFER bypass via a crafted .eps document were exploited in the wild. bsc1036453 CVE-2016-9601: An integer overflow in the bundled jbig2dec library could have been misused to...