The following updates has been released for SUSE:
openSUSE-SU-2018:2723-1: Security update for ffmpeg-4
openSUSE-SU-2018:2724-1: moderate: Security update for chromium
openSUSE-SU-2018:2727-1: moderate: Security update for okular
openSUSE-SU-2018:2728-1: moderate: Security update for chromium
openSUSE-SU-2018:2730-1: important: Security update for spice-gtk
openSUSE-SU-2018:2731-1: moderate: Security update for curl
openSUSE-SU-2018:2733-1: moderate: Security update for okular
openSUSE-SU-2018:2734-1: Security update for ffmpeg-4
openSUSE-SU-2018:2736-1: moderate: Security update for curl
openSUSE-SU-2018:2723-1: Security update for ffmpeg-4
openSUSE-SU-2018:2724-1: moderate: Security update for chromium
openSUSE-SU-2018:2727-1: moderate: Security update for okular
openSUSE-SU-2018:2728-1: moderate: Security update for chromium
openSUSE-SU-2018:2730-1: important: Security update for spice-gtk
openSUSE-SU-2018:2731-1: moderate: Security update for curl
openSUSE-SU-2018:2733-1: moderate: Security update for okular
openSUSE-SU-2018:2734-1: Security update for ffmpeg-4
openSUSE-SU-2018:2736-1: moderate: Security update for curl
openSUSE-SU-2018:2723-1: Security update for ffmpeg-4
openSUSE Security Update: Security update for ffmpeg-4
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:2723-1
Rating: low
References: #1092241 #1100348 #1105869
Cross-References: CVE-2018-13300 CVE-2018-15822
Affected Products:
openSUSE Leap 42.3
openSUSE Leap 15.0
______________________________________________________________________________
An update that solves two vulnerabilities and has one
errata is now available.
Description:
This update for ffmpeg-4 to version 4.0.2 fixes the following issues:
These security issues were fixed:
- CVE-2018-15822: The flv_write_packet function did not check for an empty
audio packet, leading to an assertion failure and DoS (bsc#1105869).
- CVE-2018-13300: An improper argument passed to the avpriv_request_sample
function may have triggered an out-of-array read while converting a
crafted AVI file to MPEG4, leading to a denial of service and possibly
an information disclosure (bsc#1100348).
These non-security issues were fixed:
- Enable webvtt encoders and decoders (boo#1092241).
- Build codec2 encoder and decoder, add libcodec2 to enable_decoders and
enable_encoders.
- Enable mpeg 1 and 2 encoders.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2018-1004=1
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2018-1004=1
Package List:
- openSUSE Leap 42.3 (i586 x86_64):
ffmpeg-4-debugsource-4.0.2-13.1
ffmpeg-4-libavcodec-devel-4.0.2-13.1
ffmpeg-4-libavdevice-devel-4.0.2-13.1
ffmpeg-4-libavfilter-devel-4.0.2-13.1
ffmpeg-4-libavformat-devel-4.0.2-13.1
ffmpeg-4-libavresample-devel-4.0.2-13.1
ffmpeg-4-libavutil-devel-4.0.2-13.1
ffmpeg-4-libpostproc-devel-4.0.2-13.1
ffmpeg-4-libswresample-devel-4.0.2-13.1
ffmpeg-4-libswscale-devel-4.0.2-13.1
ffmpeg-4-private-devel-4.0.2-13.1
libavcodec58-4.0.2-13.1
libavcodec58-debuginfo-4.0.2-13.1
libavdevice58-4.0.2-13.1
libavdevice58-debuginfo-4.0.2-13.1
libavfilter7-4.0.2-13.1
libavfilter7-debuginfo-4.0.2-13.1
libavformat58-4.0.2-13.1
libavformat58-debuginfo-4.0.2-13.1
libavresample4-4.0.2-13.1
libavresample4-debuginfo-4.0.2-13.1
libavutil56-4.0.2-13.1
libavutil56-debuginfo-4.0.2-13.1
libpostproc55-4.0.2-13.1
libpostproc55-debuginfo-4.0.2-13.1
libswresample3-4.0.2-13.1
libswresample3-debuginfo-4.0.2-13.1
libswscale5-4.0.2-13.1
libswscale5-debuginfo-4.0.2-13.1
- openSUSE Leap 42.3 (x86_64):
libavcodec58-32bit-4.0.2-13.1
libavcodec58-debuginfo-32bit-4.0.2-13.1
libavdevice58-32bit-4.0.2-13.1
libavdevice58-debuginfo-32bit-4.0.2-13.1
libavfilter7-32bit-4.0.2-13.1
libavfilter7-debuginfo-32bit-4.0.2-13.1
libavformat58-32bit-4.0.2-13.1
libavformat58-debuginfo-32bit-4.0.2-13.1
libavresample4-32bit-4.0.2-13.1
libavresample4-debuginfo-32bit-4.0.2-13.1
libavutil56-32bit-4.0.2-13.1
libavutil56-debuginfo-32bit-4.0.2-13.1
libpostproc55-32bit-4.0.2-13.1
libpostproc55-debuginfo-32bit-4.0.2-13.1
libswresample3-32bit-4.0.2-13.1
libswresample3-debuginfo-32bit-4.0.2-13.1
libswscale5-32bit-4.0.2-13.1
libswscale5-debuginfo-32bit-4.0.2-13.1
- openSUSE Leap 15.0 (x86_64):
ffmpeg-4-debugsource-4.0.2-lp150.13.1
ffmpeg-4-libavcodec-devel-4.0.2-lp150.13.1
ffmpeg-4-libavdevice-devel-4.0.2-lp150.13.1
ffmpeg-4-libavfilter-devel-4.0.2-lp150.13.1
ffmpeg-4-libavformat-devel-4.0.2-lp150.13.1
ffmpeg-4-libavresample-devel-4.0.2-lp150.13.1
ffmpeg-4-libavutil-devel-4.0.2-lp150.13.1
ffmpeg-4-libpostproc-devel-4.0.2-lp150.13.1
ffmpeg-4-libswresample-devel-4.0.2-lp150.13.1
ffmpeg-4-libswscale-devel-4.0.2-lp150.13.1
ffmpeg-4-private-devel-4.0.2-lp150.13.1
libavcodec58-4.0.2-lp150.13.1
libavcodec58-debuginfo-4.0.2-lp150.13.1
libavdevice58-4.0.2-lp150.13.1
libavdevice58-debuginfo-4.0.2-lp150.13.1
libavfilter7-4.0.2-lp150.13.1
libavfilter7-debuginfo-4.0.2-lp150.13.1
libavformat58-4.0.2-lp150.13.1
libavformat58-debuginfo-4.0.2-lp150.13.1
libavresample4-4.0.2-lp150.13.1
libavresample4-debuginfo-4.0.2-lp150.13.1
libavutil56-4.0.2-lp150.13.1
libavutil56-debuginfo-4.0.2-lp150.13.1
libpostproc55-4.0.2-lp150.13.1
libpostproc55-debuginfo-4.0.2-lp150.13.1
libswresample3-4.0.2-lp150.13.1
libswresample3-debuginfo-4.0.2-lp150.13.1
libswscale5-4.0.2-lp150.13.1
libswscale5-debuginfo-4.0.2-lp150.13.1
References:
https://www.suse.com/security/cve/CVE-2018-13300.html
https://www.suse.com/security/cve/CVE-2018-15822.html
https://bugzilla.suse.com/1092241
https://bugzilla.suse.com/1100348
https://bugzilla.suse.com/1105869
--
openSUSE-SU-2018:2724-1: moderate: Security update for chromium
openSUSE Security Update: Security update for chromium
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:2724-1
Rating: moderate
References: #1108114 #1108175
Affected Products:
SUSE Package Hub for SUSE Linux Enterprise 12
______________________________________________________________________________
An update that contains security fixes can now be installed.
Description:
This update for Chromium to version 69.0.3497.92 fixes the following
issues:
Security issues fixed ((boo#1108114):
- Function signature mismatch in WebAssembly
- URL Spoofing in Omnibox
The following tracked packaging issues were fixed:
- the chromium package incorrectly provied swiftshader resolvables
(boo#1108175)
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE Package Hub for SUSE Linux Enterprise 12:
zypper in -t patch openSUSE-2018-1005=1
Package List:
- SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64):
chromedriver-69.0.3497.92-68.1
chromedriver-debuginfo-69.0.3497.92-68.1
chromium-69.0.3497.92-68.1
chromium-debuginfo-69.0.3497.92-68.1
chromium-debugsource-69.0.3497.92-68.1
References:
https://bugzilla.suse.com/1108114
https://bugzilla.suse.com/1108175
--
openSUSE-SU-2018:2727-1: moderate: Security update for okular
openSUSE Security Update: Security update for okular
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:2727-1
Rating: moderate
References: #1107591
Cross-References: CVE-2018-1000801
Affected Products:
SUSE Package Hub for SUSE Linux Enterprise 12
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for okular fixes the following security issue:
- CVE-2018-1000801: Prevent directory traversal vulnerability in function
unpackDocumentArchive could have resulted in arbitrary file creation via
a specially crafted Okular archive (bsc#1107591).
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE Package Hub for SUSE Linux Enterprise 12:
zypper in -t patch openSUSE-2018-1006=1
Package List:
- SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64):
okular-17.04.2-11.1
okular-debuginfo-17.04.2-11.1
okular-debugsource-17.04.2-11.1
okular-devel-17.04.2-11.1
- SUSE Package Hub for SUSE Linux Enterprise 12 (noarch):
okular-lang-17.04.2-11.1
References:
https://www.suse.com/security/cve/CVE-2018-1000801.html
https://bugzilla.suse.com/1107591
--
openSUSE-SU-2018:2728-1: moderate: Security update for chromium
openSUSE Security Update: Security update for chromium
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:2728-1
Rating: moderate
References: #1108114 #1108175
Affected Products:
openSUSE Leap 42.3
openSUSE Leap 15.0
______________________________________________________________________________
An update that contains security fixes can now be installed.
Description:
This update for Chromium to version 69.0.3497.92 fixes the following
issues:
Security issues fixed ((boo#1108114):
- Function signature mismatch in WebAssembly
- URL Spoofing in Omnibox
The following tracked packaging issues were fixed:
- the chromium package incorrectly provied swiftshader resolvables
(boo#1108175)
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2018-1005=1
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2018-1005=1
Package List:
- openSUSE Leap 42.3 (x86_64):
chromedriver-69.0.3497.92-171.1
chromedriver-debuginfo-69.0.3497.92-171.1
chromium-69.0.3497.92-171.1
chromium-debuginfo-69.0.3497.92-171.1
chromium-debugsource-69.0.3497.92-171.1
- openSUSE Leap 15.0 (x86_64):
chromedriver-69.0.3497.92-lp150.2.13.1
chromedriver-debuginfo-69.0.3497.92-lp150.2.13.1
chromium-69.0.3497.92-lp150.2.13.1
chromium-debuginfo-69.0.3497.92-lp150.2.13.1
chromium-debugsource-69.0.3497.92-lp150.2.13.1
References:
https://bugzilla.suse.com/1108114
https://bugzilla.suse.com/1108175
--
openSUSE-SU-2018:2730-1: important: Security update for spice-gtk
openSUSE Security Update: Security update for spice-gtk
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:2730-1
Rating: important
References: #1101295 #1101420 #1104448
Cross-References: CVE-2018-10873 CVE-2018-10893
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________
An update that solves two vulnerabilities and has one
errata is now available.
Description:
This update for spice-gtk fixes the following issues:
Security issues fixed:
- CVE-2018-10873: Fix potential heap corruption when demarshalling
(bsc#1104448)
- CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295)
Other bugs fixed:
- Add setuid bit to spice-client-glib-usb-acl-helper (bsc#1101420)
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2018-1015=1
Package List:
- openSUSE Leap 15.0 (x86_64):
libspice-client-glib-2_0-8-0.34-lp150.2.3.1
libspice-client-glib-2_0-8-debuginfo-0.34-lp150.2.3.1
libspice-client-glib-helper-0.34-lp150.2.3.1
libspice-client-glib-helper-debuginfo-0.34-lp150.2.3.1
libspice-client-gtk-3_0-5-0.34-lp150.2.3.1
libspice-client-gtk-3_0-5-debuginfo-0.34-lp150.2.3.1
libspice-controller0-0.34-lp150.2.3.1
libspice-controller0-debuginfo-0.34-lp150.2.3.1
spice-gtk-0.34-lp150.2.3.1
spice-gtk-debuginfo-0.34-lp150.2.3.1
spice-gtk-debugsource-0.34-lp150.2.3.1
spice-gtk-devel-0.34-lp150.2.3.1
typelib-1_0-SpiceClientGlib-2_0-0.34-lp150.2.3.1
typelib-1_0-SpiceClientGtk-3_0-0.34-lp150.2.3.1
- openSUSE Leap 15.0 (noarch):
spice-gtk-lang-0.34-lp150.2.3.1
References:
https://www.suse.com/security/cve/CVE-2018-10873.html
https://www.suse.com/security/cve/CVE-2018-10893.html
https://bugzilla.suse.com/1101295
https://bugzilla.suse.com/1101420
https://bugzilla.suse.com/1104448
--
openSUSE-SU-2018:2731-1: moderate: Security update for curl
openSUSE Security Update: Security update for curl
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:2731-1
Rating: moderate
References: #1086367 #1106019
Cross-References: CVE-2018-14618
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________
An update that solves one vulnerability and has one errata
is now available.
Description:
This update for curl fixes the following issues:
This security issue was fixed:
- CVE-2018-14618: Prevent integer overflow in the NTLM authentication code
(bsc#1106019)
This non-security issue was fixed:
- Use OPENSSL_config instead of CONF_modules_load_file() to avoid crashes
due to openssl engines conflicts (bsc#1086367)
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2018-1010=1
Package List:
- openSUSE Leap 15.0 (i586 x86_64):
curl-7.60.0-lp150.2.12.1
curl-debuginfo-7.60.0-lp150.2.12.1
curl-debugsource-7.60.0-lp150.2.12.1
curl-mini-7.60.0-lp150.2.12.1
curl-mini-debuginfo-7.60.0-lp150.2.12.1
curl-mini-debugsource-7.60.0-lp150.2.12.1
libcurl-devel-7.60.0-lp150.2.12.1
libcurl-mini-devel-7.60.0-lp150.2.12.1
libcurl4-7.60.0-lp150.2.12.1
libcurl4-debuginfo-7.60.0-lp150.2.12.1
libcurl4-mini-7.60.0-lp150.2.12.1
libcurl4-mini-debuginfo-7.60.0-lp150.2.12.1
- openSUSE Leap 15.0 (x86_64):
libcurl-devel-32bit-7.60.0-lp150.2.12.1
libcurl4-32bit-7.60.0-lp150.2.12.1
libcurl4-32bit-debuginfo-7.60.0-lp150.2.12.1
References:
https://www.suse.com/security/cve/CVE-2018-14618.html
https://bugzilla.suse.com/1086367
https://bugzilla.suse.com/1106019
--
openSUSE-SU-2018:2733-1: moderate: Security update for okular
openSUSE Security Update: Security update for okular
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:2733-1
Rating: moderate
References: #1107591
Cross-References: CVE-2018-1000801
Affected Products:
openSUSE Leap 42.3
openSUSE Leap 15.0
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for okular fixes the following security issue:
- CVE-2018-1000801: Prevent directory traversal vulnerability in function
unpackDocumentArchive could have resulted in arbitrary file creation via
a specially crafted Okular archive (bsc#1107591).
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2018-1006=1
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2018-1006=1
Package List:
- openSUSE Leap 42.3 (x86_64):
okular-17.04.2-6.1
okular-debuginfo-17.04.2-6.1
okular-debugsource-17.04.2-6.1
okular-devel-17.04.2-6.1
- openSUSE Leap 42.3 (noarch):
okular-lang-17.04.2-6.1
- openSUSE Leap 15.0 (x86_64):
okular-17.12.3-lp150.3.3.1
okular-debuginfo-17.12.3-lp150.3.3.1
okular-debugsource-17.12.3-lp150.3.3.1
okular-devel-17.12.3-lp150.3.3.1
- openSUSE Leap 15.0 (noarch):
okular-lang-17.12.3-lp150.3.3.1
References:
https://www.suse.com/security/cve/CVE-2018-1000801.html
https://bugzilla.suse.com/1107591
--
openSUSE-SU-2018:2734-1: Security update for ffmpeg-4
openSUSE Security Update: Security update for ffmpeg-4
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:2734-1
Rating: low
References: #1092241 #1100348 #1105869
Cross-References: CVE-2018-13300 CVE-2018-15822
Affected Products:
SUSE Package Hub for SUSE Linux Enterprise 12
______________________________________________________________________________
An update that solves two vulnerabilities and has one
errata is now available.
Description:
This update for ffmpeg-4 to version 4.0.2 fixes the following issues:
These security issues were fixed:
- CVE-2018-15822: The flv_write_packet function did not check for an empty
audio packet, leading to an assertion failure and DoS (bsc#1105869).
- CVE-2018-13300: An improper argument passed to the avpriv_request_sample
function may have triggered an out-of-array read while converting a
crafted AVI file to MPEG4, leading to a denial of service and possibly
an information disclosure (bsc#1100348).
These non-security issues were fixed:
- Enable webvtt encoders and decoders (boo#1092241).
- Build codec2 encoder and decoder, add libcodec2 to enable_decoders and
enable_encoders.
- Enable mpeg 1 and 2 encoders.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE Package Hub for SUSE Linux Enterprise 12:
zypper in -t patch openSUSE-2018-1004=1
Package List:
- SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64):
ffmpeg-4-libavcodec-devel-4.0.2-13.1
ffmpeg-4-libavdevice-devel-4.0.2-13.1
ffmpeg-4-libavfilter-devel-4.0.2-13.1
ffmpeg-4-libavformat-devel-4.0.2-13.1
ffmpeg-4-libavresample-devel-4.0.2-13.1
ffmpeg-4-libavutil-devel-4.0.2-13.1
ffmpeg-4-libpostproc-devel-4.0.2-13.1
ffmpeg-4-libswresample-devel-4.0.2-13.1
ffmpeg-4-libswscale-devel-4.0.2-13.1
ffmpeg-4-private-devel-4.0.2-13.1
libavcodec58-4.0.2-13.1
libavdevice58-4.0.2-13.1
libavfilter7-4.0.2-13.1
libavformat58-4.0.2-13.1
libavresample4-4.0.2-13.1
libavutil56-4.0.2-13.1
libpostproc55-4.0.2-13.1
libswresample3-4.0.2-13.1
libswscale5-4.0.2-13.1
References:
https://www.suse.com/security/cve/CVE-2018-13300.html
https://www.suse.com/security/cve/CVE-2018-15822.html
https://bugzilla.suse.com/1092241
https://bugzilla.suse.com/1100348
https://bugzilla.suse.com/1105869
--
openSUSE-SU-2018:2736-1: moderate: Security update for curl
openSUSE Security Update: Security update for curl
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:2736-1
Rating: moderate
References: #1089533 #1106019
Cross-References: CVE-2018-14618
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________
An update that solves one vulnerability and has one errata
is now available.
Description:
This update for curl fixes the following issues:
This security issue was fixed:
- CVE-2018-14618: Prevent integer overflow in the NTLM authentication code
(bsc#1106019)
This non-security issue was fixed:
- Fixed erroneous debug message when paired with OpenSSL (bsc#1089533)
This update was imported from the SUSE:SLE-12:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2018-1008=1
Package List:
- openSUSE Leap 42.3 (i586 x86_64):
curl-7.37.0-39.1
curl-debuginfo-7.37.0-39.1
curl-debugsource-7.37.0-39.1
libcurl-devel-7.37.0-39.1
libcurl4-7.37.0-39.1
libcurl4-debuginfo-7.37.0-39.1
- openSUSE Leap 42.3 (x86_64):
libcurl-devel-32bit-7.37.0-39.1
libcurl4-32bit-7.37.0-39.1
libcurl4-debuginfo-32bit-7.37.0-39.1
References:
https://www.suse.com/security/cve/CVE-2018-14618.html
https://bugzilla.suse.com/1089533
https://bugzilla.suse.com/1106019
--
