SUSE-SU-2019:2953-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15-SP1 Azure Kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine...

SUSE-SU-2019:2859-1 Security update for the Linux Kernel (Live Patch 5 for SLE 15 SP1)

This update for the Linux Kernel 4.12.14-19718 fixes several issues. The following security issues were fixed: - CVE-2019-10220: Fixed a relative path escape in the Samba client module bsc1144903, bsc1153108. - CVE-2019-17133: Fixed a buffer overflow in cfg80211mgdwextgiwessid in...

SUSE-RU-2019:2767-1 Recommended update for xen

This update for xen to version 4.10.4 fixes the following issues: - Fixed an issue where libxenlight could not restore domain vsa6535522 on live migration bsc1133818. - Fixed an HPS bug which did not allow to install Windows Server 2016 with 2 CPUs setting or above bsc1137717. - Fixed an issue...

SUSE-SU-2019:2291-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 5 Fix Pack 40. Security issues fixed: - CVE-2019-11771: IBM Security Update July 2019 bsc1147021 - CVE-2019-11772: IBM Security Update July 2019 bsc1147021 - CVE-2019-11775: IBM Security Update July 2019...

SUSE-SU-2019:1861-2 Security update for MozillaFirefox

This update for MozillaFirefox, mozilla-nss fixes the following issues: MozillaFirefox to version ESR 60.8: - CVE-2019-9811: Sandbox escape via installation of malicious language pack bsc1140868. - CVE-2019-11711: Script injection within domain through inner window reuse bsc1140868. -...

SUSE-SU-2019:1869-1 Security update for MozillaFirefox

This update for MozillaFirefox, mozilla-nss fixes the following issues: MozillaFirefox to version ESR 60.8: - CVE-2019-9811: Sandbox escape via installation of malicious language pack bsc1140868. - CVE-2019-11711: Script injection within domain through inner window reuse bsc1140868. -...

SUSE-SU-2019:1746-1 Security update for php5

This update for php5 fixes the following issues: Security issues fixed: - CVE-2019-11039: Fixed a heap-buffer-overflow on phpjpgget16 bsc1138173. - CVE-2019-11040: Fixed an out-of-bounds read due to an integer overflow in iconv.c:phpiconvmimedecode bsc1138172. - CVE-2015-1351: Fixed a use after...

SUSE-SU-2019:1605-1 Security update for SDL2

This update for SDL2 fixes the following issues: - Remove the fix for CVE-2019-7637, the modification of function SDLCalculatePitch is only suited for SDL not SDL2, and breaks SDL2 software. bsc1134135...

SUSE-SU-2019:1524-1 Security update for openssh

This update for openssh fixes the following issues: Security vulnerabilities addressed: - CVE-2019-6109: Fixed an character encoding issue in the progress display of the scp client that could be used to manipulate client output, allowing for spoofing during file transfers bsc1121816. -...

SUSE-SU-2019:1208-1 Security update for sqlite3

This update for sqlite3 fixes the following issues: Security issue fixed: - CVE-2018-8740: Fixed a NULL pointer dereference related to corrupted databases schemas bsc1085790. - CVE-2017-10989: Fixed a heap-based buffer over-read in getNodeSize bsc1132045...

SUSE-SU-2019:0125-2 Security update for openssh

This update for openssh fixes the following issues: Security issue fixed: - CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions bsc1121571 - CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to...

SUSE-SU-2018:3973-2 Security update for qemu

This update for qemu fixes the following issues: Security issues fixed: - CVE-2018-10839: Fixed NE2000 NIC emulation support that is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use...

SUSE-SU-2018:4090-2 Security update for ghostscript

This update for ghostscript to version 9.26 fixes the following issues: Security issues fixed: - CVE-2018-19475: Fixed bypass of an intended access restriction in psi/zdevice2.c bsc1117327 - CVE-2018-19476: Fixed bypass of an intended access restriction in psi/zicc.c bsc1117313 - CVE-2018-19477:...

SUSE-SU-2018:4088-2 Security update for git

This update for git fixes the following issue: - CVE-2018-17456: Git allowed remote code execution during processing of a recursive 'git clone' of a superproject if a .gitmodules file has a URL field beginning with a '-' character. boo1110949...

SUSE-SU-2018:3064-3 Security update for java-1_8_0-openjdk

This update for java-180-openjdk to the jdk8u181 icedtea 3.9.0 release fixes the following issues: These security issues were fixed: - CVE-2018-2938: Difficult to exploit vulnerability allowed unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful...

SUSE-SU-2018:3864-2 Security update for openssl

This update for openssl fixes the following issues: Security issues fixed: - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation bsc1113652. - CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses bsc1113534. - CVE-2018-0737: Corrected the current erro...

SUSE-SU-2019:0988-1 Security update for php72

This update for php72 fixes the following issues: - CVE-2019-9637: Due to the way rename across filesystems is implemented, it was possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data...

SUSE-SU-2019:0973-1 Security update for sqlite3

This update for sqlite3 fixes the following issues: Security issues fixed: - CVE-2018-20506: Fixed an integer overflow when FTS3 extension is enabled bsc1131576. - CVE-2018-20346: Fixed a remote code execution vulnerability in FTS3 Magellan bsc1119687. - CVE-2016-6153: Fixed incorrect permissions...

SUSE-SU-2019:0901-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP3 Azure kernel was updated to 4.4.176 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc1129179. - CVE-2019-9213: expanddownwards ...

SUSE-SU-2019:0873-1 Security update for apache2

This update for apache2 fixes the following issues: CVE-2019-0211: A flaw in the Apache HTTP Server allowed less-privileged child processes or threads to execute arbitrary code with the privileges of the parent process. Attackers with control over CGI scripts or extension modules run by the serve...

SUSE-SU-2019:0771-1 Security update for gd

This update for gd fixes the following issues: Security issues fixed: - CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function bsc1123361. - CVE-2019-6978: Fixed a double free in the gdImagePtr functions bsc1123522...

SUSE-SU-2019:0765-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915 driver were fixed which might have lead to information leaks. bnc1122971. - CVE-2019-3459,...

SUSE-SU-2018:4294-1 Security update for libqt5-qtbase

This update for libqt5-qtbase fixes the following issues: Security issues fixed: - CVE-2018-15518: Fixed double free in QXmlStreamReader bsc1118595 - CVE-2018-19873: Fixed Denial of Service on malformed BMP file in QBmpHandler bsc1118596...

SUSE-SU-2018:3624-1 Security update for curl

This update for curl fixes the following issues: - CVE-2018-16839: A SASL password overflow via integer overflow was fixed which could lead to crashes bsc1112758 - CVE-2018-16840: A use-after-free in SASL handle close was fixed which could lead to crashes bsc1112758 - CVE-2018-16842: A...

SUSE-SU-2018:3393-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2018-11784: When the default servlet in Apache Tomcat returned a redirect to a directory e.g. redirecting to '/foo/' when the user requested '/foo' a specially crafted URL could be used to cause the redirect to be generated to any URI of th...

SUSE-SU-2018:2839-2 Security update for java-1_8_0-ibm

This update for java-180-ibm to 8.0.5.20 fixes the following security issues: - CVE-2018-2952: Vulnerability in subcomponent: Concurrency. Difficult to exploit vulnerability allowed unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRocki...

SUSE-SU-2018:1764-2 Security update for java-1_7_1-ibm

IBM Java was updated to 7.1.4.25 bsc1093311, bsc1085449: Security fixes: - CVE-2018-2814 CVE-2018-2794 CVE-2018-2783 CVE-2018-2799 CVE-2018-2798 CVE-2018-2797 CVE-2018-2796 CVE-2018-2795 CVE-2018-2800 CVE-2018-2790 CVE-2018-1417...

SUSE-SU-2018:3159-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-17182: The vmacacheflushall function in mm/vmacache.c mishandled sequence number overflows. An attacker can trigger a use-after-free and possibly gain...

SUSE-SU-2018:2815-1 Security update for apache2

This update for apache2 fixes the following issues: Security issues fixed: - CVE-2016-8743: Fixed liberal whitespace interpretation accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chai...

SUSE-SU-2018:2678-1 Security update for the Linux Kernel (Live Patch 2 for SLE 15)

This update for the Linux Kernel 4.12.14-256 fixes several issues. The following security issues were fixed: - CVE-2018-15471: An issue was discovered in xenvifsethashmapping in drivers/net/xen-netback/hash.c. The Linux netback driver allowed frontends to control mapping of requests to request...

SUSE-SU-2018:2574-1 Security update for java-1_7_0-ibm

This update for java-170-ibm fixes the following issues: Security issues fixed: - CVE-2018-1517: Fixed a flaw in the java.math component in IBM SDK, which may allow an attacker to inflict a denial-of-service attack with specially crafted String data. - CVE-2018-1656: Protect against path traversa...

SUSE-SU-2018:2550-1 Security update for cobbler

This update for cobbler fixes the following issues: Security issue fixed: - CVE-2018-10931: Forbid exposure of private methods in the API bsc1104287, bsc1104189...

SUSE-SU-2018:2299-1 Security update for ceph

This update for ceph fixes the following issues: Security issues fixed: - CVE-2018-10861: Fix ceph-mon authorization on OSD pool ops bsc1099162. - CVE-2018-1128: Fix cephx signature check bypass bsc1096748. - CVE-2018-1129: Fix cephx protocol vulnerability to replay attack bsc1096748. -...

SUSE-SU-2018:2217-1 Security update for rubygem-sprockets-2_12

This update for rubygem-sprockets-212 fixes the following issues: Security issue fixed: - CVE-2018-3760: Fix path traversal in sprockets/server.rb:forbiddenrequest? that can allow remote attackers to read arbitrary files bsc1098369...

SUSE-SU-2018:2041-1 Security update for openssl-1_1

This update for openssl-11 fixes the following issues: - CVE-2018-0732: During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating a...

SUSE-SU-2018:1938-2 Security update for java-1_8_0-openjdk

This update for java-180-openjdk to version 8u171 fixes the following issues: These security issues were fixed: - S8180881: Better packaging of deserialization - S8182362: Update CipherOutputStream Usage - S8183032: Upgrade to LittleCMS 2.9 - S8189123: More consistent classloading - S8189969,...

SUSE-SU-2018:1938-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk to version 8u171 fixes the following issues: These security issues were fixed: - S8180881: Better packaging of deserialization - S8182362: Update CipherOutputStream Usage - S8183032: Upgrade to LittleCMS 2.9 - S8189123: More consistent classloading - S8189969,...

SUSE-SU-2018:1853-1 Recommended update for mariadb

This MariaDB update to version 10.2.15 brings the following fixes and improvements. Security issues: - CVE-2018-2767: The embedded server library now supports SSL when connecting to remote servers bsc1088681. - Collected CVEs fixes: 10.2.15: CVE-2018-2786, CVE-2018-2759, CVE-2018-2777,...

SUSE-SU-2018:1825-1 Security update for jpeg

This update for jpeg fixes the following issues: CVE-2017-15232: NULL pointer dereferences in jdpostct.c and jquant1.c could lead to denial of service crash when processing images bsc1062937 CVE-2018-11813: Fixed the end-of-file mishandling in readpixel in rdtarga.c, which allowed remote attacker...

SUSE-SU-2018:1660-1 Security update for pdns

This update for pdns fixes the following issues: Security issues fixed: - CVE-2018-1046: Fix an issue with replaying a specially crafted PCAP file that can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution bsc1092540...

SUSE-SU-2018:1534-1 Security update for the Linux Kernel (Live Patch 12 for SLE 12 SP2)

This update for the Linux Kernel 4.4.74-9235 fixes several issues. The following security issues were fixed: - CVE-2017-13166: An elevation of privilege vulnerability in the kernel v4l2 video driver was fixed. bsc1085447. - CVE-2018-8897: A statement in the System Programming Guide of the Intel 6...

SUSE-SU-2018:1482-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. This update main focus is a regression fix in SystemV IPC handling. bsc1093600 The following non-security bugs were fixed: - Drop cBPF SSBD as classic BPF does not really have a proper concept of pointer...

SUSE-SU-2018:1294-1 Security update for php53

This update for php53 fixes the following issues: Security issues fixed: - CVE-2018-10545: Fix access controls in FPM child processes bsc1091367. - CVE-2018-10547: Fix Reflected XSS on the PHAR 403 and 404 error pages bsc1091362. - CVE-2018-10546: Fix an infinite loop exists in ext/iconv/iconv.c...

SUSE-SU-2018:1161-1 Security update for apache2

This update for apache2 fixes the following issues: CVE-2018-1283: when modsession is configured to forward its session data to CGI applications SessionEnv on, not the default, a remote user may influence their content by using a 'Session' header leading to unexpected behavior bsc1086814...

SUSE-SU-2018:1079-1 Security update for apache2

This update for apache2 fixes the following issues: - security update: CVE-2018-1301: Specially crafted requests, in debug mode, could lead to denial of service. bsc1086817 CVE-2017-15710: failure in the language fallback handling could lead to denial of service. bsc1086776 CVE-2018-1312: Seed...

SUSE-SU-2018:1074-1 Security update for perl

This update for perl fixes the following issues: Security issues fixed: - CVE-2018-6913: Fixed space calculation issues in pppack.c bsc1082216. - CVE-2018-6798: Fixed heap buffer overflow in regexec.c bsc1082233. - CVE-2018-6797: Fixed sharp-s regexp overflow bsc1082234...

SUSE-SU-2018:0926-1 Security update for policycoreutils

This update for policycoreutils fixes the following issues: - CVE-2018-1063: Fixed problem to prevent chcon from following symlinks in /tmp, /var/tmp, /var/run and /var/lib/debug bsc1083624...

SUSE-SU-2018:0810-1 Security update for dhcp

This update for dhcp fixes the following issues: Security issues fixed: - CVE-2018-5733: reference count overflow in dhcpd bsc1083303. - CVE-2018-5732: buffer overflow in dhclient bsc1083302...

SUSE-SU-2018:0817-1 Security update for tomcat

This update for tomcat fixes the following issues: Security issues fixed: - CVE-2018-1305: Fixed late application of security constraints that can lead to resource exposure for unauthorised users bsc1082481. - CVE-2018-1304: Fixed incorrect handling of empty string URL in security constraints tha...

SUSE-SU-2018:0762-1 Security update for qemu

This update for qemu fixes the following issues: This update has the next round of Spectre v2 related patches, which now integrate with corresponding changes in libvirt. CVE-2017-5715 bsc1068032 The January 2018 release of qemu initially addressed the Spectre v2 vulnerability for KVM guests by...