The following security updates has been released for openSUSE:

openSUSE-SU-2018:1621-1: important: Security update for libvirt
openSUSE-SU-2018:1622-1: moderate: Security update for libvorbis
openSUSE-SU-2018:1623-1: important: Security update for xen
openSUSE-SU-2018:1624-1: moderate: Security update for curl
openSUSE-SU-2018:1625-1: important: Security update for slf4j
openSUSE-SU-2018:1627-1: moderate: Security update for prosody
openSUSE-SU-2018:1628-1: important: Security update for qemu
openSUSE-SU-2018:1629-1: moderate: Security update for ImageMagick
openSUSE-SU-2018:1631-1: moderate: Security update for kernel-firmware
openSUSE-SU-2018:1632-1: moderate: Security update for prosody
openSUSE-SU-2018:1633-1: moderate: Security update for glibc
openSUSE-SU-2018:1634-1: moderate: Security update for mupdf

openSUSE-SU-2018:1621-1: important: Security update for libvirt

openSUSE Security Update: Security update for libvirt
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:1621-1
Rating: important
References: #1092885
Cross-References: CVE-2018-3639
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for libvirt fixes the following issues:

This update fixes the following security issue:

- Added support for 'ssbd' and 'virt-ssbd' CPUID feature bits
(CVE-2018-3639, boo#1092885)


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-602=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

libvirt-4.0.0-lp150.7.3.1
libvirt-admin-4.0.0-lp150.7.3.1
libvirt-admin-debuginfo-4.0.0-lp150.7.3.1
libvirt-client-4.0.0-lp150.7.3.1
libvirt-client-debuginfo-4.0.0-lp150.7.3.1
libvirt-daemon-4.0.0-lp150.7.3.1
libvirt-daemon-config-network-4.0.0-lp150.7.3.1
libvirt-daemon-config-nwfilter-4.0.0-lp150.7.3.1
libvirt-daemon-debuginfo-4.0.0-lp150.7.3.1
libvirt-daemon-driver-interface-4.0.0-lp150.7.3.1
libvirt-daemon-driver-interface-debuginfo-4.0.0-lp150.7.3.1
libvirt-daemon-driver-lxc-4.0.0-lp150.7.3.1
libvirt-daemon-driver-lxc-debuginfo-4.0.0-lp150.7.3.1
libvirt-daemon-driver-network-4.0.0-lp150.7.3.1
libvirt-daemon-driver-network-debuginfo-4.0.0-lp150.7.3.1
libvirt-daemon-driver-nodedev-4.0.0-lp150.7.3.1
libvirt-daemon-driver-nodedev-debuginfo-4.0.0-lp150.7.3.1
libvirt-daemon-driver-nwfilter-4.0.0-lp150.7.3.1
libvirt-daemon-driver-nwfilter-debuginfo-4.0.0-lp150.7.3.1
libvirt-daemon-driver-qemu-4.0.0-lp150.7.3.1
libvirt-daemon-driver-qemu-debuginfo-4.0.0-lp150.7.3.1
libvirt-daemon-driver-secret-4.0.0-lp150.7.3.1
libvirt-daemon-driver-secret-debuginfo-4.0.0-lp150.7.3.1
libvirt-daemon-driver-storage-4.0.0-lp150.7.3.1
libvirt-daemon-driver-storage-core-4.0.0-lp150.7.3.1
libvirt-daemon-driver-storage-core-debuginfo-4.0.0-lp150.7.3.1
libvirt-daemon-driver-storage-disk-4.0.0-lp150.7.3.1
libvirt-daemon-driver-storage-disk-debuginfo-4.0.0-lp150.7.3.1
libvirt-daemon-driver-storage-iscsi-4.0.0-lp150.7.3.1
libvirt-daemon-driver-storage-iscsi-debuginfo-4.0.0-lp150.7.3.1
libvirt-daemon-driver-storage-logical-4.0.0-lp150.7.3.1
libvirt-daemon-driver-storage-logical-debuginfo-4.0.0-lp150.7.3.1
libvirt-daemon-driver-storage-mpath-4.0.0-lp150.7.3.1
libvirt-daemon-driver-storage-mpath-debuginfo-4.0.0-lp150.7.3.1
libvirt-daemon-driver-storage-scsi-4.0.0-lp150.7.3.1
libvirt-daemon-driver-storage-scsi-debuginfo-4.0.0-lp150.7.3.1
libvirt-daemon-driver-uml-4.0.0-lp150.7.3.1
libvirt-daemon-driver-uml-debuginfo-4.0.0-lp150.7.3.1
libvirt-daemon-driver-vbox-4.0.0-lp150.7.3.1
libvirt-daemon-driver-vbox-debuginfo-4.0.0-lp150.7.3.1
libvirt-daemon-hooks-4.0.0-lp150.7.3.1
libvirt-daemon-lxc-4.0.0-lp150.7.3.1
libvirt-daemon-qemu-4.0.0-lp150.7.3.1
libvirt-daemon-uml-4.0.0-lp150.7.3.1
libvirt-daemon-vbox-4.0.0-lp150.7.3.1
libvirt-debugsource-4.0.0-lp150.7.3.1
libvirt-devel-4.0.0-lp150.7.3.1
libvirt-doc-4.0.0-lp150.7.3.1
libvirt-libs-4.0.0-lp150.7.3.1
libvirt-libs-debuginfo-4.0.0-lp150.7.3.1
libvirt-lock-sanlock-4.0.0-lp150.7.3.1
libvirt-lock-sanlock-debuginfo-4.0.0-lp150.7.3.1
libvirt-nss-4.0.0-lp150.7.3.1
libvirt-nss-debuginfo-4.0.0-lp150.7.3.1
wireshark-plugin-libvirt-4.0.0-lp150.7.3.1
wireshark-plugin-libvirt-debuginfo-4.0.0-lp150.7.3.1

- openSUSE Leap 15.0 (x86_64):

libvirt-client-32bit-debuginfo-4.0.0-lp150.7.3.1
libvirt-daemon-driver-libxl-4.0.0-lp150.7.3.1
libvirt-daemon-driver-libxl-debuginfo-4.0.0-lp150.7.3.1
libvirt-daemon-driver-storage-rbd-4.0.0-lp150.7.3.1
libvirt-daemon-driver-storage-rbd-debuginfo-4.0.0-lp150.7.3.1
libvirt-daemon-xen-4.0.0-lp150.7.3.1
libvirt-devel-32bit-4.0.0-lp150.7.3.1


References:

https://www.suse.com/security/cve/CVE-2018-3639.html
https://bugzilla.suse.com/1092885

--

openSUSE-SU-2018:1622-1: moderate: Security update for libvorbis

openSUSE Security Update: Security update for libvorbis
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:1622-1
Rating: moderate
References: #1091070
Cross-References: CVE-2018-10392
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for libvorbis fixes the following issues:

The following security issue was fixed:

- Fixed the validation of channels in mapping0_forward(), which previously
allowed remote attackers to cause a denial of service via specially
crafted files (CVE-2018-10392, bsc#1091070)

This update was imported from the SUSE:SLE-12:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-591=1



Package List:

- openSUSE Leap 42.3 (i586 x86_64):

libvorbis-debugsource-1.3.3-17.1
libvorbis-devel-1.3.3-17.1
libvorbis0-1.3.3-17.1
libvorbis0-debuginfo-1.3.3-17.1
libvorbisenc2-1.3.3-17.1
libvorbisenc2-debuginfo-1.3.3-17.1
libvorbisfile3-1.3.3-17.1
libvorbisfile3-debuginfo-1.3.3-17.1

- openSUSE Leap 42.3 (noarch):

libvorbis-doc-1.3.3-17.1

- openSUSE Leap 42.3 (x86_64):

libvorbis0-32bit-1.3.3-17.1
libvorbis0-debuginfo-32bit-1.3.3-17.1
libvorbisenc2-32bit-1.3.3-17.1
libvorbisenc2-debuginfo-32bit-1.3.3-17.1
libvorbisfile3-32bit-1.3.3-17.1
libvorbisfile3-debuginfo-32bit-1.3.3-17.1


References:

https://www.suse.com/security/cve/CVE-2018-10392.html
https://bugzilla.suse.com/1091070

--

openSUSE-SU-2018:1623-1: important: Security update for xen

openSUSE Security Update: Security update for xen
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:1623-1
Rating: important
References: #1027519 #1074562 #1079730 #1092631
Cross-References: CVE-2017-5715 CVE-2017-5753 CVE-2017-5754
CVE-2018-3639
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes four vulnerabilities is now available.

Description:

This update for xen to version 4.10.1 fixes several issues (bsc#1027519).

These security issues were fixed:

- CVE-2018-3639: Prevent attackers with local user access from extracting
information via a side-channel analysis, aka Speculative Store Bypass
(SSB), Variant 4 (bsc#1092631).
- CVE-2017-5753,CVE-2017-5715,CVE-2017-5754: Improved Spectre v2
mitigations (bsc#1074562).

This non-security issue was fixed:

- Always call qemus xen-save-devices-state in suspend/resume to fix
migration with qcow2 images (bsc#1079730)


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-599=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

xen-debugsource-4.10.1_04-lp150.2.3.1
xen-devel-4.10.1_04-lp150.2.3.1
xen-libs-4.10.1_04-lp150.2.3.1
xen-libs-debuginfo-4.10.1_04-lp150.2.3.1
xen-tools-domU-4.10.1_04-lp150.2.3.1
xen-tools-domU-debuginfo-4.10.1_04-lp150.2.3.1

- openSUSE Leap 15.0 (x86_64):

xen-4.10.1_04-lp150.2.3.1
xen-doc-html-4.10.1_04-lp150.2.3.1
xen-libs-32bit-4.10.1_04-lp150.2.3.1
xen-libs-32bit-debuginfo-4.10.1_04-lp150.2.3.1
xen-tools-4.10.1_04-lp150.2.3.1
xen-tools-debuginfo-4.10.1_04-lp150.2.3.1


References:

https://www.suse.com/security/cve/CVE-2017-5715.html
https://www.suse.com/security/cve/CVE-2017-5753.html
https://www.suse.com/security/cve/CVE-2017-5754.html
https://www.suse.com/security/cve/CVE-2018-3639.html
https://bugzilla.suse.com/1027519
https://bugzilla.suse.com/1074562
https://bugzilla.suse.com/1079730
https://bugzilla.suse.com/1092631

--

openSUSE-SU-2018:1624-1: moderate: Security update for curl

openSUSE Security Update: Security update for curl
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:1624-1
Rating: moderate
References: #1092094 #1092098
Cross-References: CVE-2018-1000300 CVE-2018-1000301
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes two vulnerabilities is now available.

Description:

This update for curl to version 7.60.0 fixes the following issues:

These security issues were fixed:

- CVE-2018-1000300: Prevent heap-based buffer overflow when closing down
an FTP connection with very long server command replies (bsc#1092094).
- CVE-2018-1000301: Prevent buffer over-read that could have cause reading
data beyond the end of a heap based buffer used to store downloaded RTSP
content (bsc#1092098).

These non-security issues were fixed:

- Add CURLOPT_HAPROXYPROTOCOL, support for the HAProxy PROXY protocol
- Add --haproxy-protocol for the command line tool
- Add CURLOPT_DNS_SHUFFLE_ADDRESSES, shuffle returned IP addresses
- FTP: fix typo in recursive callback detection for seeking
- test1208: marked flaky
- HTTP: make header-less responses still count correct body size
- user-agent.d:: mention --proxy-header as well
- http2: fixes typo
- cleanup: misc typos in strings and comments
- rate-limit: use three second window to better handle high speeds
- examples/hiperfifo.c: improved
- pause: when changing pause state, update socket state
- curl_version_info.3: fix ssl_version description
- add_handle/easy_perform: clear errorbuffer on start if set
- cmake: add support for brotli
- parsedate: support UT timezone
- vauth/ntlm.h: fix the #ifdef header guard
- lib/curl_path.h: added #ifdef header guard
- vauth/cleartext: fix integer overflow check
- CURLINFO_COOKIELIST.3: made the example not leak memory
- cookie.d: mention that "-" as filename means stdin
- CURLINFO_SSL_VERIFYRESULT.3: fixed the example
- http2: read pending frames (including GOAWAY) in connection-check
- timeval: remove compilation warning by casting
- cmake: avoid warn-as-error during config checks
- travis-ci: enable -Werror for CMake builds
- openldap: fix for NULL return from ldap_get_attribute_ber()
- threaded resolver: track resolver time and set suitable timeout values
- cmake: Add advapi32 as explicit link library for win32
- docs: fix CURLINFO_*_T examples use of CURL_FORMAT_CURL_OFF_T
- test1148: set a fixed locale for the test
- cookies: when reading from a file, only remove_expired once
- cookie: store cookies per top-level-domain-specific hash table
- openssl: RESTORED verify locations when verifypeer==0
- file: restore old behavior for file:////foo/bar URLs
- FTP: allow PASV on IPv6 connections when a proxy is being used
- build-openssl.bat: allow custom paths for VS and perl
- winbuild: make the clean target work without build-type
- build-openssl.bat: Refer to VS2017 as VC14.1 instead of VC15
- curl: retry on FTP 4xx, ignore other protocols
- configure: detect (and use) sa_family_t
- examples/sftpuploadresume: Fix Windows large file seek
- build: cleanup to fix clang warnings/errors
- winbuild: updated the documentation
- lib: silence null-dereference warnings
- travis: bump to clang 6 and gcc 7
- travis: build libpsl and make builds use it
- proxy: show getenv proxy use in verbose output
- duphandle: make sure CURLOPT_RESOLVE is duplicated
- all: Refactor malloc+memset to use calloc
- checksrc: Fix typo
- system.h: Add sparcv8plus to oracle/sunpro 32-bit detection
- vauth: Fix typo
- ssh: show libSSH2 error code when closing fails
- test1148: tolerate progress updates better
- urldata: make service names unconditional
- configure: keep LD_LIBRARY_PATH changes local
- ntlm_sspi: fix authentication using Credential Manager
- schannel: add client certificate authentication
- winbuild: Support custom devel paths for each dependency
- schannel: add support for CURLOPT_CAINFO
- http2: handle on_begin_headers() called more than once
- openssl: support OpenSSL 1.1.1 verbose-mode trace messages
- openssl: fix subjectAltName check on non-ASCII platforms
- http2: avoid strstr() on data not zero terminated
- http2: clear the "drain counter" when a stream is closed
- http2: handle GOAWAY properly
- tool_help: clarify --max-time unit of time is seconds
- curl.1: clarify that options and URLs can be mixed
- http2: convert an assert to run-time check
- curl_global_sslset: always provide available backends
- ftplistparser: keep state between invokes
- Curl_memchr: zero length input can't match
- examples/sftpuploadresume: typecast fseek argument to long
- examples/http2-upload: expand buffer to avoid silly warning
- ctype: restore character classification for non-ASCII platforms
- mime: avoid NULL pointer dereference risk
- cookies: ensure that we have cookies before writing jar
- os400.c: fix checksrc warnings
- configure: provide --with-wolfssl as an alias for --with-cyassl
- cyassl: adapt to libraries without TLS 1.0 support built-in
- http2: get rid of another strstr
- checksrc: force indentation of lines after an else
- cookies: remove unused macro
- CURLINFO_PROTOCOL.3: mention the existing defined names
- tests: provide 'manual' as a feature to optionally require
- travis: enable libssh2 on both macos and Linux
- CURLOPT_URL.3: added ENCODING section
- wolfssl: Fix non-blocking connect
- vtls: don't define MD5_DIGEST_LENGTH for wolfssl
- docs: remove extraneous commas in man pages
- URL: fix ASCII dependency in strcpy_url and strlen_url
- ssh-libssh.c: fix left shift compiler warning
- configure: only check for CA bundle for file-using SSL backends
- travis: add an mbedtls build
- http: don't set the "rewind" flag when not uploading anything
- configure: put CURLDEBUG and DEBUGBUILD in lib/curl_config.h
- transfer: don't unset writesockfd on setup of multiplexed conns
- vtls: use unified "supports" bitfield member in backends
- URLs: fix one more http url
- travis: add a build using WolfSSL
- openssl: change FILE ops to BIO ops
- travis: add build using NSS
- smb: reject negative file sizes
- cookies: accept parameter names as cookie name
- http2: getsock fix for uploads
- all over: fixed format specifiers
- http2: use the correct function pointer typedef


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-589=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

curl-7.60.0-lp150.2.3.1
curl-debuginfo-7.60.0-lp150.2.3.1
curl-debugsource-7.60.0-lp150.2.3.1
curl-mini-7.60.0-lp150.2.3.1
curl-mini-debuginfo-7.60.0-lp150.2.3.1
curl-mini-debugsource-7.60.0-lp150.2.3.1
libcurl-devel-7.60.0-lp150.2.3.1
libcurl-mini-devel-7.60.0-lp150.2.3.1
libcurl4-7.60.0-lp150.2.3.1
libcurl4-debuginfo-7.60.0-lp150.2.3.1
libcurl4-mini-7.60.0-lp150.2.3.1
libcurl4-mini-debuginfo-7.60.0-lp150.2.3.1

- openSUSE Leap 15.0 (x86_64):

libcurl-devel-32bit-7.60.0-lp150.2.3.1
libcurl4-32bit-7.60.0-lp150.2.3.1
libcurl4-32bit-debuginfo-7.60.0-lp150.2.3.1


References:

https://www.suse.com/security/cve/CVE-2018-1000300.html
https://www.suse.com/security/cve/CVE-2018-1000301.html
https://bugzilla.suse.com/1092094
https://bugzilla.suse.com/1092098

--

openSUSE-SU-2018:1625-1: important: Security update for slf4j

openSUSE Security Update: Security update for slf4j
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:1625-1
Rating: important
References: #1085970
Cross-References: CVE-2018-8088
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for slf4j fixes the following security issue:

- CVE-2018-8088: Remote attackers could have bypassed intended access
restrictions via crafted data. Disallow EventData deserialization by
default from now on (bsc#1085970).


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-601=1



Package List:

- openSUSE Leap 15.0 (noarch):

slf4j-1.7.12-lp150.4.3.1
slf4j-javadoc-1.7.12-lp150.4.3.1
slf4j-manual-1.7.12-lp150.4.3.1


References:

https://www.suse.com/security/cve/CVE-2018-8088.html
https://bugzilla.suse.com/1085970

--

openSUSE-SU-2018:1627-1: moderate: Security update for prosody

openSUSE Security Update: Security update for prosody
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:1627-1
Rating: moderate
References: #1094890
Cross-References: CVE-2018-10847
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for prosody fixes the following issues:

This security issue was fixed:

- CVE-2018-10847: Prevent insufficient validation of client-provided
parameters during XMPP stream restarts. Authenticated users may have
overriden the realm associated with their session, potentially bypassing
security policies and allowing impersonation (bsc#1094890).


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-597=1



Package List:

- openSUSE Leap 42.3 (i586 x86_64):

prosody-0.9.13-2.6.1
prosody-debuginfo-0.9.13-2.6.1
prosody-debugsource-0.9.13-2.6.1


References:

https://www.suse.com/security/cve/CVE-2018-10847.html
https://bugzilla.suse.com/1094890

--

openSUSE-SU-2018:1628-1: important: Security update for qemu

openSUSE Security Update: Security update for qemu
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:1628-1
Rating: important
References: #1092885 #1093169
Cross-References: CVE-2018-3639
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that solves one vulnerability and has one errata
is now available.

Description:

This update for qemu fixes the following issues:

This security issue was fixed:

- CVE-2018-3639: Spectre v4 vulnerability mitigation support for KVM
guests (bsc#1092885).

Systems with microprocessors utilizing speculative execution and
speculative execution of memory reads before the addresses of all prior
memory writes are known may allow unauthorized disclosure of information
to an attacker with local user access via a side-channel analysis.

This patch permits the new x86 cpu feature flag named "ssbd" to be
presented to the guest, given that the host has this feature, and KVM
exposes it to the guest as well.

For this feature to be enabled please use the qemu commandline
-cpu $MODEL,+spec-ctrl,+ssbd so the guest OS can take advantage of the
feature.

spec-ctrl and ssbd support is also required in the host.

This non-security issue was fixed:

- Fix qemu-guest-agent uninstall (boo#1093169)


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-603=1



Package List:

- openSUSE Leap 15.0 (x86_64):

qemu-2.11.1-lp150.7.3.1
qemu-arm-2.11.1-lp150.7.3.1
qemu-arm-debuginfo-2.11.1-lp150.7.3.1
qemu-block-curl-2.11.1-lp150.7.3.1
qemu-block-curl-debuginfo-2.11.1-lp150.7.3.1
qemu-block-dmg-2.11.1-lp150.7.3.1
qemu-block-dmg-debuginfo-2.11.1-lp150.7.3.1
qemu-block-gluster-2.11.1-lp150.7.3.1
qemu-block-gluster-debuginfo-2.11.1-lp150.7.3.1
qemu-block-iscsi-2.11.1-lp150.7.3.1
qemu-block-iscsi-debuginfo-2.11.1-lp150.7.3.1
qemu-block-rbd-2.11.1-lp150.7.3.1
qemu-block-rbd-debuginfo-2.11.1-lp150.7.3.1
qemu-block-ssh-2.11.1-lp150.7.3.1
qemu-block-ssh-debuginfo-2.11.1-lp150.7.3.1
qemu-debuginfo-2.11.1-lp150.7.3.1
qemu-debugsource-2.11.1-lp150.7.3.1
qemu-extra-2.11.1-lp150.7.3.1
qemu-extra-debuginfo-2.11.1-lp150.7.3.1
qemu-guest-agent-2.11.1-lp150.7.3.1
qemu-guest-agent-debuginfo-2.11.1-lp150.7.3.1
qemu-ksm-2.11.1-lp150.7.3.1
qemu-kvm-2.11.1-lp150.7.3.1
qemu-lang-2.11.1-lp150.7.3.1
qemu-linux-user-2.11.1-lp150.7.3.1
qemu-linux-user-debuginfo-2.11.1-lp150.7.3.1
qemu-linux-user-debugsource-2.11.1-lp150.7.3.1
qemu-ppc-2.11.1-lp150.7.3.1
qemu-ppc-debuginfo-2.11.1-lp150.7.3.1
qemu-s390-2.11.1-lp150.7.3.1
qemu-s390-debuginfo-2.11.1-lp150.7.3.1
qemu-testsuite-2.11.1-lp150.7.3.1
qemu-tools-2.11.1-lp150.7.3.1
qemu-tools-debuginfo-2.11.1-lp150.7.3.1
qemu-x86-2.11.1-lp150.7.3.1
qemu-x86-debuginfo-2.11.1-lp150.7.3.1

- openSUSE Leap 15.0 (noarch):

qemu-ipxe-1.0.0-lp150.7.3.1
qemu-seabios-1.11.0-lp150.7.3.1
qemu-sgabios-8-lp150.7.3.1
qemu-vgabios-1.11.0-lp150.7.3.1


References:

https://www.suse.com/security/cve/CVE-2018-3639.html
https://bugzilla.suse.com/1092885
https://bugzilla.suse.com/1093169

--

openSUSE-SU-2018:1629-1: moderate: Security update for ImageMagick

openSUSE Security Update: Security update for ImageMagick
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:1629-1
Rating: moderate
References: #1093395
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that contains security fixes can now be installed.

Description:

This update for ImageMagick to version 7.0.7-34 fixes the following issues:

The following security issue was fixed:

- Fixed numerous use of uninitialized values, integer overflow, memory
exceeded, and timeouts.

The following non-security issues were fixed:

- Added support for reading eXIf chunks to the PNG coder.
- Improved clip / composite mask handling.
- Restore SetImageAlpha() behavior.
- Fix -clip and -mask options.
- Missing break when checking "compliance" element.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-598=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

ImageMagick-7.0.7.34-lp150.2.3.1
ImageMagick-debuginfo-7.0.7.34-lp150.2.3.1
ImageMagick-debugsource-7.0.7.34-lp150.2.3.1
ImageMagick-devel-7.0.7.34-lp150.2.3.1
ImageMagick-extra-7.0.7.34-lp150.2.3.1
ImageMagick-extra-debuginfo-7.0.7.34-lp150.2.3.1
libMagick++-7_Q16HDRI4-7.0.7.34-lp150.2.3.1
libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp150.2.3.1
libMagick++-devel-7.0.7.34-lp150.2.3.1
libMagickCore-7_Q16HDRI6-7.0.7.34-lp150.2.3.1
libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.3.1
libMagickWand-7_Q16HDRI6-7.0.7.34-lp150.2.3.1
libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.3.1
perl-PerlMagick-7.0.7.34-lp150.2.3.1
perl-PerlMagick-debuginfo-7.0.7.34-lp150.2.3.1

- openSUSE Leap 15.0 (noarch):

ImageMagick-doc-7.0.7.34-lp150.2.3.1

- openSUSE Leap 15.0 (x86_64):

ImageMagick-devel-32bit-7.0.7.34-lp150.2.3.1
libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp150.2.3.1
libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp150.2.3.1
libMagick++-devel-32bit-7.0.7.34-lp150.2.3.1
libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.3.1
libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.3.1
libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.3.1
libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.3.1


References:

https://bugzilla.suse.com/1093395

--

openSUSE-SU-2018:1631-1: moderate: Security update for kernel-firmware

openSUSE Security Update: Security update for kernel-firmware
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:1631-1
Rating: moderate
References: #1095735
Cross-References: CVE-2017-5715
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for kernel-firmware fixes the following issues:

This security issue was fixed:

- CVE-2017-5715: Prevent unauthorized disclosure of information to an
attacker with local user access caused by speculative execution and
indirect branch prediction (bsc#1095735)

This update was imported from the SUSE:SLE-12-SP2:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-590=1



Package List:

- openSUSE Leap 42.3 (noarch):

kernel-firmware-20170530-20.1
ucode-amd-20170530-20.1


References:

https://www.suse.com/security/cve/CVE-2017-5715.html
https://bugzilla.suse.com/1095735

--

openSUSE-SU-2018:1632-1: moderate: Security update for prosody

openSUSE Security Update: Security update for prosody
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:1632-1
Rating: moderate
References: #1094890
Cross-References: CVE-2018-10847
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for prosody to version 0.10.2 fixes the following issues:

This security issue was fixed:

- CVE-2018-10847: Prevent insufficient validation of client-provided
parameters during XMPP stream restarts. Authenticated users may have
overriden the realm associated with their session, potentially bypassing
security policies and allowing impersonation (bsc#1094890).

These non-security issues were fixed:

- mod_websocket: Store the request object on the session for use by other
modules
- mod_c2s: Avoid concatenating potential nil value
- core.certmanager: Allow all non-whitespace in service name
- mod_disco: Skip code specific to disco on user accounts
- mod_bosh: Store the normalized hostname on session
- MUC: Fix error logged when no persistent rooms present


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-596=1



Package List:

- openSUSE Leap 15.0 (x86_64):

prosody-0.10.2-lp150.3.6.2
prosody-debuginfo-0.10.2-lp150.3.6.2
prosody-debugsource-0.10.2-lp150.3.6.2


References:

https://www.suse.com/security/cve/CVE-2018-10847.html
https://bugzilla.suse.com/1094890

--

openSUSE-SU-2018:1633-1: moderate: Security update for glibc

openSUSE Security Update: Security update for glibc
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:1633-1
Rating: moderate
References: #1092877 #1094154
Cross-References: CVE-2018-11237
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that solves one vulnerability and has one errata
is now available.

Description:

This update for glibc fixes the following issues:

This security issue was fixed:

- Fixed an buffer overwrite issue in memcpy for Knights Landing CPUs
(boo#1092877, CVE-2018-11237)


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-600=1



Package List:

- openSUSE Leap 15.0 (i586 i686 x86_64):

glibc-2.26-lp150.11.3.2
glibc-debuginfo-2.26-lp150.11.3.2
glibc-debugsource-2.26-lp150.11.3.2
glibc-devel-2.26-lp150.11.3.2
glibc-devel-debuginfo-2.26-lp150.11.3.2
glibc-devel-static-2.26-lp150.11.3.2
glibc-locale-2.26-lp150.11.3.2
glibc-locale-debuginfo-2.26-lp150.11.3.2
glibc-profile-2.26-lp150.11.3.2

- openSUSE Leap 15.0 (i586 x86_64):

glibc-extra-2.26-lp150.11.3.2
glibc-extra-debuginfo-2.26-lp150.11.3.2
glibc-utils-2.26-lp150.11.3.2
glibc-utils-debuginfo-2.26-lp150.11.3.2
glibc-utils-src-debugsource-2.26-lp150.11.3.2
nscd-2.26-lp150.11.3.2
nscd-debuginfo-2.26-lp150.11.3.2

- openSUSE Leap 15.0 (noarch):

glibc-html-2.26-lp150.11.3.2
glibc-i18ndata-2.26-lp150.11.3.2
glibc-info-2.26-lp150.11.3.2

- openSUSE Leap 15.0 (x86_64):

glibc-32bit-2.26-lp150.11.3.2
glibc-32bit-debuginfo-2.26-lp150.11.3.2
glibc-devel-32bit-2.26-lp150.11.3.2
glibc-devel-32bit-debuginfo-2.26-lp150.11.3.2
glibc-devel-static-32bit-2.26-lp150.11.3.2
glibc-locale-32bit-2.26-lp150.11.3.2
glibc-locale-32bit-debuginfo-2.26-lp150.11.3.2
glibc-profile-32bit-2.26-lp150.11.3.2
glibc-utils-32bit-2.26-lp150.11.3.2
glibc-utils-32bit-debuginfo-2.26-lp150.11.3.2


References:

https://www.suse.com/security/cve/CVE-2018-11237.html
https://bugzilla.suse.com/1092877
https://bugzilla.suse.com/1094154

--

openSUSE-SU-2018:1634-1: moderate: Security update for mupdf

openSUSE Security Update: Security update for mupdf
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:1634-1
Rating: moderate
References: #1080531
Cross-References: CVE-2018-1000051
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for mupdf fixes the following security issue:

- CVE-2018-1000051: Prevent use after free in fz_keep_key_storable that
can result in DOS / possible code execution. This attack appear to be
exploitable via Victim opens a specially crafted PDF (bsc#1080531).


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-592=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

mupdf-1.12.0-lp150.3.3.1
mupdf-debuginfo-1.12.0-lp150.3.3.1
mupdf-debugsource-1.12.0-lp150.3.3.1
mupdf-devel-static-1.12.0-lp150.3.3.1


References:

https://www.suse.com/security/cve/CVE-2018-1000051.html
https://bugzilla.suse.com/1080531

--