The following updates has been released for openSUSE:

openSUSE-SU-2018:1595-1: moderate: Security update for mariadb
This update addresses 16 security issues and 9 bugs in MariaDB. Available for openSUSE Leap 15.0

openSUSE-SU-2018:1596-1: important: Security update for xdg-utils
This update fixes a security issue where the open_envvar function in xdg-open did not validate strings launching the program specified by the BROWSER environment variable, which might allowed remote attackers to conduct argument-injection attacks via a crafted URL. Available for openSUSE Leap 15.0

openSUSE-SU-2018:1600-1: important: Security update for glibc
This update addresses 3 security issues in glibc and 1 non security bug. Available for openSUSE Leap 42.3

openSUSE-SU-2018:1595-1: moderate: Security update for mariadb

openSUSE Security Update: Security update for mariadb
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:1595-1
Rating: moderate
References: #1088681 #1089987 #1090518 #1092544
Cross-References: CVE-2018-2755 CVE-2018-2759 CVE-2018-2761
CVE-2018-2766 CVE-2018-2767 CVE-2018-2771
CVE-2018-2777 CVE-2018-2781 CVE-2018-2782
CVE-2018-2784 CVE-2018-2786 CVE-2018-2787
CVE-2018-2810 CVE-2018-2813 CVE-2018-2817
CVE-2018-2819
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes 16 vulnerabilities is now available.

Description:

This update for mariadb to version 10.2.15 fixes the following issues:

These security issues were fixed:

- CVE-2018-2767: Enforse use of SSL/TLS in embedded server library (Return
of BACKRONYM) (bsc#1088681).
- CVE-2018-2786: Vulnerability in the MySQL Server component of Oracle
MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed
high privileged attacker with network access via multiple protocols to
compromise MySQL Server. Successful attacks of this vulnerability can
result in unauthorized ability to cause a hang or frequently repeatable
crash (complete DOS) of MySQL Server as well as unauthorized update,
insert or delete access to some of MySQL Server accessible data
(bsc#1089987).
- CVE-2018-2759: Vulnerability in the MySQL Server component of Oracle
MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed
high privileged attacker with network access via multiple protocols to
compromise MySQL Server. Successful attacks of this vulnerability can
result in unauthorized ability to cause a hang or frequently repeatable
crash (complete DOS) of MySQL Server (bsc#1089987).
- CVE-2018-2777: Vulnerability in the MySQL Server component of Oracle
MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed
high privileged attacker with network access via multiple protocols to
compromise MySQL Server. Successful attacks of this vulnerability can
result in unauthorized ability to cause a hang or frequently repeatable
crash (complete DOS) of MySQL Server (bsc#1089987).
- CVE-2018-2810: Vulnerability in the MySQL Server component of Oracle
MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed
high privileged attacker with network access via multiple protocols to
compromise MySQL Server. Successful attacks of this vulnerability can
result in unauthorized ability to cause a hang or frequently repeatable
crash (complete DOS) of MySQL Server (bsc#1089987).
- CVE-2018-2782: Vulnerability in the MySQL Server component of Oracle
MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed
low privileged attacker with network access via multiple protocols to
compromise MySQL Server. Successful attacks of this vulnerability can
result in unauthorized ability to cause a hang or frequently repeatable
crash (complete DOS) of MySQL Server (bsc#1089987, bsc#1090518).
- CVE-2018-2784: Vulnerability in the MySQL Server component of Oracle
MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed
low privileged attacker with network access via multiple protocols to
compromise MySQL Server. Successful attacks of this vulnerability can
result in unauthorized ability to cause a hang or frequently repeatable
crash (complete DOS) of MySQL Server (bsc#1089987, bsc#1090518).
- CVE-2018-2787: Vulnerability in the MySQL Server component of Oracle
MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed
high privileged attacker with network access via multiple protocols to
compromise MySQL Server. Successful attacks of this vulnerability can
result in unauthorized ability to cause a hang or frequently repeatable
crash (complete DOS) of MySQL Server as well as unauthorized update,
insert or delete access to some of MySQL Server accessible data
(bsc#1089987, bsc#1090518).
- CVE-2018-2766: Vulnerability in the MySQL Server component of Oracle
MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed
high privileged attacker with network access via multiple protocols to
compromise MySQL Server. Successful attacks of this vulnerability can
result in unauthorized ability to cause a hang or frequently repeatable
crash (complete DOS) of MySQL Server (bsc#1089987, bsc#1090518).
- CVE-2018-2755: Vulnerability in the MySQL Server component of Oracle
MySQL (subcomponent: Server: Replication). Difficult to exploit
vulnerability allowed unauthenticated attacker with logon to the
infrastructure where MySQL Server executes to compromise MySQL Server.
Successful attacks require human interaction from a person other than
the attacker and while the vulnerability is in MySQL Server, attacks may
significantly impact additional products. Successful attacks of this
vulnerability can result in takeover of MySQL Server (bsc#1089987,
bsc#1090518).
- CVE-2018-2819: Vulnerability in the MySQL Server component of Oracle
MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed
low privileged attacker with network access via multiple protocols to
compromise MySQL Server. Successful attacks of this vulnerability can
result in unauthorized ability to cause a hang or frequently repeatable
crash (complete DOS) of MySQL Server (bsc#1089987, bsc#1090518).
- CVE-2018-2817: Vulnerability in the MySQL Server component of Oracle
MySQL (subcomponent: Server: DDL). Easily exploitable vulnerability
allowed low privileged attacker with network access via multiple
protocols to compromise MySQL Server. Successful attacks of this
vulnerability can result in unauthorized ability to cause a hang or
frequently repeatable crash (complete DOS) of MySQL Server (bsc#1089987,
bsc#1090518).
- CVE-2018-2761: Vulnerability in the MySQL Server component of Oracle
MySQL (subcomponent: Client programs). Difficult to exploit
vulnerability allowed unauthenticated attacker with network access via
multiple protocols to compromise MySQL Server. Successful attacks of
this vulnerability can result in unauthorized ability to cause a hang or
frequently repeatable crash (complete DOS) of MySQL Server (bsc#1089987,
bsc#1090518).
- CVE-2018-2781: Vulnerability in the MySQL Server component of Oracle
MySQL (subcomponent: Server: Optimizer). Easily exploitable
vulnerability allowed high privileged attacker with network access via
multiple protocols to compromise MySQL Server. Successful attacks of
this vulnerability can result in unauthorized ability to cause a hang or
frequently repeatable crash (complete DOS) of MySQL Server (bsc#1089987,
bsc#1090518).
- CVE-2018-2771: Vulnerability in the MySQL Server component of Oracle
MySQL (subcomponent: Server: Locking). Difficult to exploit
vulnerability allowed high privileged attacker with network access via
multiple protocols to compromise MySQL Server. Successful attacks of
this vulnerability can result in unauthorized ability to cause a hang or
frequently repeatable crash (complete DOS) of MySQL Server (bsc#1089987,
bsc#1090518).
- CVE-2018-2813: Vulnerability in the MySQL Server component of Oracle
MySQL (subcomponent: Server: DDL). Easily exploitable vulnerability
allowed low privileged attacker with network access via multiple
protocols to compromise MySQL Server. Successful attacks of this
vulnerability can result in unauthorized read access to a subset of
MySQL Server accessible data (bsc#1089987, bsc#1090518).

These non-security issues were fixed:

- PCRE updated to 8.42
- Incomplete validation of missing tablespace during recovery
- ib_buffer_pool unnecessarily includes the temporary tablespace
- InnoDB may write uninitialized garbage to redo log
- Virtual Columns: Assertion failed in dict_table_get_col_name
- slow innodb startup/shutdown can exceed systemd timeout
- Assertion failed in dict_check_sys_tables on upgrade from 5.5
- Change buffer crash during TRUNCATE or DROP TABLE
- temporary table ROLLBACK fixes

For additional details please see

- https://mariadb.com/kb/en/library/mariadb-10215-release-notes
- https://mariadb.com/kb/en/library/mariadb-10215-changelog


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-572=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

libmysqld-devel-10.2.15-lp150.2.3.2
libmysqld19-10.2.15-lp150.2.3.2
libmysqld19-debuginfo-10.2.15-lp150.2.3.2
mariadb-10.2.15-lp150.2.3.2
mariadb-bench-10.2.15-lp150.2.3.2
mariadb-bench-debuginfo-10.2.15-lp150.2.3.2
mariadb-client-10.2.15-lp150.2.3.2
mariadb-client-debuginfo-10.2.15-lp150.2.3.2
mariadb-debuginfo-10.2.15-lp150.2.3.2
mariadb-debugsource-10.2.15-lp150.2.3.2
mariadb-galera-10.2.15-lp150.2.3.2
mariadb-test-10.2.15-lp150.2.3.2
mariadb-test-debuginfo-10.2.15-lp150.2.3.2
mariadb-tools-10.2.15-lp150.2.3.2
mariadb-tools-debuginfo-10.2.15-lp150.2.3.2

- openSUSE Leap 15.0 (noarch):

mariadb-errormessages-10.2.15-lp150.2.3.2


References:

https://www.suse.com/security/cve/CVE-2018-2755.html
https://www.suse.com/security/cve/CVE-2018-2759.html
https://www.suse.com/security/cve/CVE-2018-2761.html
https://www.suse.com/security/cve/CVE-2018-2766.html
https://www.suse.com/security/cve/CVE-2018-2767.html
https://www.suse.com/security/cve/CVE-2018-2771.html
https://www.suse.com/security/cve/CVE-2018-2777.html
https://www.suse.com/security/cve/CVE-2018-2781.html
https://www.suse.com/security/cve/CVE-2018-2782.html
https://www.suse.com/security/cve/CVE-2018-2784.html
https://www.suse.com/security/cve/CVE-2018-2786.html
https://www.suse.com/security/cve/CVE-2018-2787.html
https://www.suse.com/security/cve/CVE-2018-2810.html
https://www.suse.com/security/cve/CVE-2018-2813.html
https://www.suse.com/security/cve/CVE-2018-2817.html
https://www.suse.com/security/cve/CVE-2018-2819.html
https://bugzilla.suse.com/1088681
https://bugzilla.suse.com/1089987
https://bugzilla.suse.com/1090518
https://bugzilla.suse.com/1092544

--

openSUSE-SU-2018:1596-1: important: Security update for xdg-utils

openSUSE Security Update: Security update for xdg-utils
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:1596-1
Rating: important
References: #1093086
Cross-References: CVE-2017-18266
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for xdg-utils fixes this security issues:

- CVE-2017-18266: The open_envvar function in xdg-open did not validate
strings launching the program specified by the BROWSER environment
variable, which might allowed remote attackers to conduct
argument-injection attacks via a crafted URL (bsc#1093086).


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-573=1



Package List:

- openSUSE Leap 15.0 (noarch):

xdg-utils-20170508-lp150.3.3.2


References:

https://www.suse.com/security/cve/CVE-2017-18266.html
https://bugzilla.suse.com/1093086

--

openSUSE-SU-2018:1600-1: important: Security update for glibc

openSUSE Security Update: Security update for glibc
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:1600-1
Rating: important
References: #1086690 #1094150 #1094154 #1094161
Cross-References: CVE-2017-18269 CVE-2018-11236 CVE-2018-11237

Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that solves three vulnerabilities and has one
errata is now available.

Description:

This update for glibc fixes the following issues:

- CVE-2017-18269: Fix SSE2 memmove issue when crossing 2GB boundary
(bsc#1094150)
- CVE-2018-11236: Fix overflow in path length computation (bsc#1094161)
- CVE-2018-11237: Don't write beyond buffer destination in
__mempcpy_avx512_no_vzeroupper (bsc#1094154)

Non security bugs fixed:

- Fix crash in resolver on memory allocation failure (bsc#1086690)

This update was imported from the SUSE:SLE-12-SP2:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-567=1



Package List:

- openSUSE Leap 42.3 (i586 x86_64):

glibc-2.22-19.1
glibc-debuginfo-2.22-19.1
glibc-debugsource-2.22-19.1
glibc-devel-2.22-19.1
glibc-devel-debuginfo-2.22-19.1
glibc-devel-static-2.22-19.1
glibc-extra-2.22-19.1
glibc-extra-debuginfo-2.22-19.1
glibc-locale-2.22-19.1
glibc-locale-debuginfo-2.22-19.1
glibc-profile-2.22-19.1
glibc-utils-2.22-19.1
glibc-utils-debuginfo-2.22-19.1
glibc-utils-debugsource-2.22-19.1
nscd-2.22-19.1
nscd-debuginfo-2.22-19.1

- openSUSE Leap 42.3 (noarch):

glibc-html-2.22-19.1
glibc-i18ndata-2.22-19.1
glibc-info-2.22-19.1

- openSUSE Leap 42.3 (x86_64):

glibc-32bit-2.22-19.2
glibc-debuginfo-32bit-2.22-19.2
glibc-devel-32bit-2.22-19.2
glibc-devel-debuginfo-32bit-2.22-19.2
glibc-devel-static-32bit-2.22-19.2
glibc-locale-32bit-2.22-19.2
glibc-locale-debuginfo-32bit-2.22-19.2
glibc-profile-32bit-2.22-19.2
glibc-utils-32bit-2.22-19.1
glibc-utils-debuginfo-32bit-2.22-19.1

- openSUSE Leap 42.3 (i586):

glibc-obsolete-2.22-19.1
glibc-obsolete-debuginfo-2.22-19.1

- openSUSE Leap 42.3 (i686):

glibc-2.22-19.2
glibc-debuginfo-2.22-19.2
glibc-debugsource-2.22-19.2
glibc-devel-2.22-19.2
glibc-devel-debuginfo-2.22-19.2
glibc-devel-static-2.22-19.2
glibc-locale-2.22-19.2
glibc-locale-debuginfo-2.22-19.2
glibc-profile-2.22-19.2


References:

https://www.suse.com/security/cve/CVE-2017-18269.html
https://www.suse.com/security/cve/CVE-2018-11236.html
https://www.suse.com/security/cve/CVE-2018-11237.html
https://bugzilla.suse.com/1086690
https://bugzilla.suse.com/1094150
https://bugzilla.suse.com/1094154
https://bugzilla.suse.com/1094161

--