The following updates has been released for openSUSE:

openSUSE-SU-2018:2859-1: moderate: Security update for php5-smarty3
openSUSE-SU-2018:2880-1: moderate: Security update for tiff
openSUSE-SU-2018:2881-1: important: Security update for libzypp, zypper
openSUSE-SU-2018:2885-1: moderate: Security update for shadow

openSUSE-SU-2018:2859-1: moderate: Security update for php5-smarty3

openSUSE Security Update: Security update for php5-smarty3
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:2859-1
Rating: moderate
References: #1108741
Cross-References: CVE-2018-16381
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for php5-smarty3 fixes the following issues:

- CVE-2018-16381: Prevent traversal vulnerability due to insufficient
template code sanitization that allowed attackers controlling the
executed template code to bypass the trusted directory security
restriction and read arbitrary files (bsc#1108741).


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-1052=1



Package List:

- openSUSE Leap 42.3 (noarch):

php5-smarty3-3.1.33-5.5.1
php5-smarty3-doc-3.1.33-5.5.1


References:

https://www.suse.com/security/cve/CVE-2018-16381.html
https://bugzilla.suse.com/1108741

--

openSUSE-SU-2018:2880-1: moderate: Security update for tiff

openSUSE Security Update: Security update for tiff
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:2880-1
Rating: moderate
References: #1074186 #1092480 #983440
Cross-References: CVE-2016-5319 CVE-2017-17942 CVE-2018-10779

Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that fixes three vulnerabilities is now available.

Description:

This update for tiff fixes the following issues:

Security issues fixed:

- CVE-2018-10779: Fixed a heap-based buffer overflow in
TIFFWriteScanline() in tif_write.c (bsc#1092480)
- CVE-2017-17942: Fixed a heap-based buffer overflow in the function
PackBitsEncode in tif_packbits.c. (bsc#1074186)
- CVE-2016-5319: Fixed a beap-based buffer overflow in bmp2tiff
(bsc#983440)

This update was imported from the SUSE:SLE-12:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-1056=1



Package List:

- openSUSE Leap 42.3 (i586 x86_64):

libtiff-devel-4.0.9-34.1
libtiff5-4.0.9-34.1
libtiff5-debuginfo-4.0.9-34.1
tiff-4.0.9-34.1
tiff-debuginfo-4.0.9-34.1
tiff-debugsource-4.0.9-34.1

- openSUSE Leap 42.3 (x86_64):

libtiff-devel-32bit-4.0.9-34.1
libtiff5-32bit-4.0.9-34.1
libtiff5-debuginfo-32bit-4.0.9-34.1


References:

https://www.suse.com/security/cve/CVE-2016-5319.html
https://www.suse.com/security/cve/CVE-2017-17942.html
https://www.suse.com/security/cve/CVE-2018-10779.html
https://bugzilla.suse.com/1074186
https://bugzilla.suse.com/1092480
https://bugzilla.suse.com/983440

--

openSUSE-SU-2018:2881-1: important: Security update for libzypp, zypper

openSUSE Security Update: Security update for libzypp, zypper
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:2881-1
Rating: important
References: #1036304 #1049825 #1070851 #1076192 #1088705
#1091624 #1092413 #1096803 #1099847 #1100028
#1101349 #1102429
Cross-References: CVE-2018-7685
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that solves one vulnerability and has 11 fixes is
now available.

Description:

This update for libzypp, zypper fixes the following issues:

Update libzypp to version 16.17.20:

Security issues fixed:

- PackageProvider: Validate delta rpms before caching (bsc#1091624,
bsc#1088705, CVE-2018-7685)
- PackageProvider: Validate downloaded rpm package signatures before
caching (bsc#1091624, bsc#1088705, CVE-2018-7685)

Other bugs fixed:

- lsof: use '-K i' if lsof supports it (bsc#1099847, bsc#1036304)
- Handle http error 502 Bad Gateway in curl backend (bsc#1070851)
- RepoManager: Explicitly request repo2solv to generate application pseudo
packages.
- libzypp-devel should not require cmake (bsc#1101349)
- HardLocksFile: Prevent against empty commit without Target having been
been loaded (bsc#1096803)
- Avoid zombie tar processes (bsc#1076192)

Update to zypper to version 1.13.45:

Other bugs fixed:

- XML attribute `packages-to-change` added (bsc#1102429)
- man: Strengthen that `--config FILE' affects zypper.conf, not zypp.conf
(bsc#1100028)
- Prevent nested calls to exit() if aborted by a signal (bsc#1092413)
- ansi.h: Prevent ESC sequence strings from going out of scope
(bsc#1092413)
- Fix: zypper bash completion expands non-existing options (bsc#1049825)

This update was imported from the SUSE:SLE-12-SP3:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-1054=1



Package List:

- openSUSE Leap 42.3 (i586 x86_64):

libzypp-16.17.20-27.1
libzypp-debuginfo-16.17.20-27.1
libzypp-debugsource-16.17.20-27.1
libzypp-devel-16.17.20-27.1
libzypp-devel-doc-16.17.20-27.1
zypper-1.13.45-20.1
zypper-debuginfo-1.13.45-20.1
zypper-debugsource-1.13.45-20.1

- openSUSE Leap 42.3 (noarch):

zypper-aptitude-1.13.45-20.1
zypper-log-1.13.45-20.1


References:

https://www.suse.com/security/cve/CVE-2018-7685.html
https://bugzilla.suse.com/1036304
https://bugzilla.suse.com/1049825
https://bugzilla.suse.com/1070851
https://bugzilla.suse.com/1076192
https://bugzilla.suse.com/1088705
https://bugzilla.suse.com/1091624
https://bugzilla.suse.com/1092413
https://bugzilla.suse.com/1096803
https://bugzilla.suse.com/1099847
https://bugzilla.suse.com/1100028
https://bugzilla.suse.com/1101349
https://bugzilla.suse.com/1102429

--

openSUSE-SU-2018:2885-1: moderate: Security update for shadow

openSUSE Security Update: Security update for shadow
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:2885-1
Rating: moderate
References: #1106914
Cross-References: CVE-2018-16588
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for shadow fixes the following security issue:

- CVE-2018-16588: Prevent useradd from creating intermediate directories
with mode 0777 (bsc#1106914)

This update was imported from the SUSE:SLE-12-SP2:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-1055=1



Package List:

- openSUSE Leap 42.3 (i586 x86_64):

shadow-4.2.1-20.1
shadow-debuginfo-4.2.1-20.1
shadow-debugsource-4.2.1-20.1


References:

https://www.suse.com/security/cve/CVE-2018-16588.html
https://bugzilla.suse.com/1106914

--