Chromium/Bind/Webkit2GTK3/FreeImage Updates for openSUSE

SUSE 5130 Published by

The following updates has been released for openSUSE:

openSUSE-SU-2018:0313-1: important: Security update for chromium
openSUSE-SU-2018:0323-1: important: Security update for bind
openSUSE-SU-2018:0326-1: important: Security update for webkit2gtk3
openSUSE-SU-2018:0329-1: important: Security update for freeimage



openSUSE-SU-2018:0313-1: important: Security update for chromium

openSUSE Security Update: Security update for chromium
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:0313-1
Rating: important
References: #1073323 #1077571 #1077722
Cross-References: CVE-2017-15420 CVE-2018-6031 CVE-2018-6032
CVE-2018-6033 CVE-2018-6034 CVE-2018-6035
CVE-2018-6036 CVE-2018-6037 CVE-2018-6038
CVE-2018-6039 CVE-2018-6040 CVE-2018-6041
CVE-2018-6042 CVE-2018-6043 CVE-2018-6045
CVE-2018-6046 CVE-2018-6047 CVE-2018-6048
CVE-2018-6049 CVE-2018-6050 CVE-2018-6051
CVE-2018-6052 CVE-2018-6053 CVE-2018-6054

Affected Products:
SUSE Package Hub for SUSE Linux Enterprise 12
______________________________________________________________________________

An update that fixes 24 vulnerabilities is now available.

Description:

This update for chromium to 64.0.3282.119 fixes several issues.

These security issues were fixed:

- CVE-2018-6031: Use after free in PDFium (boo#1077571)
- CVE-2018-6032: Same origin bypass in Shared Worker (boo#1077571)
- CVE-2018-6033: Race when opening downloaded files (boo#1077571)
- CVE-2018-6034: Integer overflow in Blink (boo#1077571)
- CVE-2018-6035: Insufficient isolation of devtools from extensions
(boo#1077571)
- CVE-2018-6036: Integer underflow in WebAssembly (boo#1077571)
- CVE-2018-6037: Insufficient user gesture requirements in autofill
(boo#1077571)
- CVE-2018-6038: Heap buffer overflow in WebGL (boo#1077571)
- CVE-2018-6039: XSS in DevTools (boo#1077571)
- CVE-2018-6040: Content security policy bypass (boo#1077571)
- CVE-2018-6041: URL spoof in Navigation (boo#1077571)
- CVE-2018-6042: URL spoof in OmniBox (boo#1077571)
- CVE-2018-6043: Insufficient escaping with external URL handlers
(boo#1077571)
- CVE-2018-6045: Insufficient isolation of devtools from extensions
(boo#1077571)
- CVE-2018-6046: Insufficient isolation of devtools from extensions
(boo#1077571)
- CVE-2018-6047: Cross origin URL leak in WebGL (boo#1077571)
- CVE-2018-6048: Referrer policy bypass in Blink (boo#1077571)
- CVE-2017-15420: URL spoofing in Omnibox (boo#1077571)
- CVE-2018-6049: UI spoof in Permissions (boo#1077571)
- CVE-2018-6050: URL spoof in OmniBox (boo#1077571)
- CVE-2018-6051: Referrer leak in XSS Auditor (boo#1077571)
- CVE-2018-6052: Incomplete no-referrer policy implementation (boo#1077571)
- CVE-2018-6053: Leak of page thumbnails in New Tab Page (boo#1077571)
- CVE-2018-6054: Use after free in WebUI (boo#1077571)

Re was updated to version 2018-01-01 (boo#1073323)


Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

- SUSE Package Hub for SUSE Linux Enterprise 12:

zypper in -t patch openSUSE-2018-106=1

To bring your system up-to-date, use "zypper patch".


Package List:

- SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64):

libre2-0-20180101-5.1
libre2-0-debuginfo-20180101-5.1
re2-debugsource-20180101-5.1
re2-devel-20180101-5.1

- SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64):

chromedriver-64.0.3282.119-46.2
chromium-64.0.3282.119-46.2


References:

https://www.suse.com/security/cve/CVE-2017-15420.html
https://www.suse.com/security/cve/CVE-2018-6031.html
https://www.suse.com/security/cve/CVE-2018-6032.html
https://www.suse.com/security/cve/CVE-2018-6033.html
https://www.suse.com/security/cve/CVE-2018-6034.html
https://www.suse.com/security/cve/CVE-2018-6035.html
https://www.suse.com/security/cve/CVE-2018-6036.html
https://www.suse.com/security/cve/CVE-2018-6037.html
https://www.suse.com/security/cve/CVE-2018-6038.html
https://www.suse.com/security/cve/CVE-2018-6039.html
https://www.suse.com/security/cve/CVE-2018-6040.html
https://www.suse.com/security/cve/CVE-2018-6041.html
https://www.suse.com/security/cve/CVE-2018-6042.html
https://www.suse.com/security/cve/CVE-2018-6043.html
https://www.suse.com/security/cve/CVE-2018-6045.html
https://www.suse.com/security/cve/CVE-2018-6046.html
https://www.suse.com/security/cve/CVE-2018-6047.html
https://www.suse.com/security/cve/CVE-2018-6048.html
https://www.suse.com/security/cve/CVE-2018-6049.html
https://www.suse.com/security/cve/CVE-2018-6050.html
https://www.suse.com/security/cve/CVE-2018-6051.html
https://www.suse.com/security/cve/CVE-2018-6052.html
https://www.suse.com/security/cve/CVE-2018-6053.html
https://www.suse.com/security/cve/CVE-2018-6054.html
https://bugzilla.suse.com/1073323
https://bugzilla.suse.com/1077571
https://bugzilla.suse.com/1077722

--


openSUSE-SU-2018:0323-1: important: Security update for bind

openSUSE Security Update: Security update for bind
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:0323-1
Rating: important
References: #1040039 #1047184 #1076118
Cross-References: CVE-2017-3145
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that solves one vulnerability and has two fixes
is now available.

Description:

This update for bind fixes several issues.

This security issue was fixed:

- CVE-2017-3145: Improper sequencing during cleanup could have lead to a
use-after-free error that triggered an assertion failure and crash in
named (bsc#1076118).

These non-security issues were fixed:

- Updated named.root file (bsc#1040039)
- Update bind.keys for DNSSEC root KSK rollover (bsc#1047184)

This update was imported from the SUSE:SLE-12-SP1:Update update project.


Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-114=1

To bring your system up-to-date, use "zypper patch".


Package List:

- openSUSE Leap 42.3 (i586 x86_64):

bind-9.9.9P1-53.1
bind-chrootenv-9.9.9P1-53.1
bind-debuginfo-9.9.9P1-53.1
bind-debugsource-9.9.9P1-53.1
bind-devel-9.9.9P1-53.1
bind-libs-9.9.9P1-53.1
bind-libs-debuginfo-9.9.9P1-53.1
bind-lwresd-9.9.9P1-53.1
bind-lwresd-debuginfo-9.9.9P1-53.1
bind-utils-9.9.9P1-53.1
bind-utils-debuginfo-9.9.9P1-53.1

- openSUSE Leap 42.3 (x86_64):

bind-libs-32bit-9.9.9P1-53.1
bind-libs-debuginfo-32bit-9.9.9P1-53.1

- openSUSE Leap 42.3 (noarch):

bind-doc-9.9.9P1-53.1


References:

https://www.suse.com/security/cve/CVE-2017-3145.html
https://bugzilla.suse.com/1040039
https://bugzilla.suse.com/1047184
https://bugzilla.suse.com/1076118

--


openSUSE-SU-2018:0326-1: important: Security update for webkit2gtk3

openSUSE Security Update: Security update for webkit2gtk3
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:0326-1
Rating: important
References: #1020950 #1024749 #1050469 #1066892 #1069925
#1073654 #1075419
Cross-References: CVE-2016-4692 CVE-2016-4743 CVE-2016-7586
CVE-2016-7587 CVE-2016-7589 CVE-2016-7592
CVE-2016-7598 CVE-2016-7599 CVE-2016-7610
CVE-2016-7623 CVE-2016-7632 CVE-2016-7635
CVE-2016-7639 CVE-2016-7641 CVE-2016-7645
CVE-2016-7652 CVE-2016-7654 CVE-2016-7656
CVE-2017-13788 CVE-2017-13798 CVE-2017-13803
CVE-2017-13856 CVE-2017-13866 CVE-2017-13870
CVE-2017-2350 CVE-2017-2354 CVE-2017-2355
CVE-2017-2356 CVE-2017-2362 CVE-2017-2363
CVE-2017-2364 CVE-2017-2365 CVE-2017-2366
CVE-2017-2369 CVE-2017-2371 CVE-2017-2373
CVE-2017-2496 CVE-2017-2510 CVE-2017-2539
CVE-2017-5715 CVE-2017-5753 CVE-2017-5754
CVE-2017-7006 CVE-2017-7011 CVE-2017-7012
CVE-2017-7018 CVE-2017-7019 CVE-2017-7020
CVE-2017-7030 CVE-2017-7034 CVE-2017-7037
CVE-2017-7038 CVE-2017-7039 CVE-2017-7040
CVE-2017-7041 CVE-2017-7042 CVE-2017-7043
CVE-2017-7046 CVE-2017-7048 CVE-2017-7049
CVE-2017-7052 CVE-2017-7055 CVE-2017-7056
CVE-2017-7059 CVE-2017-7061 CVE-2017-7064
CVE-2017-7081 CVE-2017-7087 CVE-2017-7089
CVE-2017-7090 CVE-2017-7091 CVE-2017-7092
CVE-2017-7093 CVE-2017-7094 CVE-2017-7095
CVE-2017-7096 CVE-2017-7098 CVE-2017-7099
CVE-2017-7100 CVE-2017-7102 CVE-2017-7104
CVE-2017-7107 CVE-2017-7109 CVE-2017-7111
CVE-2017-7117 CVE-2017-7120 CVE-2017-7142
CVE-2017-7156 CVE-2017-7157
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that fixes 89 vulnerabilities is now available.

Description:



This update for webkit2gtk3 fixes the following issues:

Update to version 2.18.5:

+ Disable SharedArrayBuffers from Web API.
+ Reduce the precision of "high" resolution time to 1ms.
+ bsc#1075419 - Security fixes: includes improvements to mitigate the
effects of Spectre and Meltdown (CVE-2017-5753 and CVE-2017-5715).

Update to version 2.18.4:

+ Make WebDriver implementation more spec compliant.
+ Fix a bug when trying to remove cookies before a web process is
spawned.
+ WebKitWebDriver process no longer links to libjavascriptcoregtk.
+ Fix several memory leaks in GStreamer media backend.
+ bsc#1073654 - Security fixes: CVE-2017-13866, CVE-2017-13870,
CVE-2017-7156, CVE-2017-13856.

Update to version 2.18.3:

+ Improve calculation of font metrics to prevent scrollbars from being
shown unnecessarily in some cases.
+ Fix handling of null capabilities in WebDriver implementation.
+ Security fixes: CVE-2017-13798, CVE-2017-13788, CVE-2017-13803.

Update to version 2.18.2:

+ Fix rendering of arabic text.
+ Fix a crash in the web process when decoding GIF images.
+ Fix rendering of wind in Windy.com.
+ Fix several crashes and rendering issues.

Update to version 2.18.1:

+ Improve performance of GIF animations.
+ Fix garbled display in GMail.
+ Fix rendering of several material design icons when using the web font.
+ Fix flickering when resizing the window in Wayland.
+ Prevent default kerberos authentication credentials from being used in
ephemeral sessions.
+ Fix a crash when webkit_web_resource_get_data() is cancelled.
+ Correctly handle touchmove and touchend events in WebKitWebView.
+ Fix the build with enchant 2.1.1.
+ Fix the build in HPPA and Alpha.
+ Fix several crashes and rendering issues.
+ Security fixes: CVE-2017-7081, CVE-2017-7087, CVE-2017-7089,
CVE-2017-7090, CVE-2017-7091, CVE-2017-7092, CVE-2017-7093,
CVE-2017-7094, CVE-2017-7095, CVE-2017-7096, CVE-2017-7098,
CVE-2017-7099, CVE-2017-7100, CVE-2017-7102, CVE-2017-7104,
CVE-2017-7107, CVE-2017-7109, CVE-2017-7111, CVE-2017-7117,
CVE-2017-7120, CVE-2017-7142.

- Enable gold linker on s390/s390x on SLE15/Tumbleweed.

This update was imported from the SUSE:SLE-12-SP2:Update update project.


Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-118=1

To bring your system up-to-date, use "zypper patch".


Package List:

- openSUSE Leap 42.3 (i586 x86_64):

libjavascriptcoregtk-4_0-18-2.18.5-8.1
libjavascriptcoregtk-4_0-18-debuginfo-2.18.5-8.1
libwebkit2gtk-4_0-37-2.18.5-8.1
libwebkit2gtk-4_0-37-debuginfo-2.18.5-8.1
typelib-1_0-JavaScriptCore-4_0-2.18.5-8.1
typelib-1_0-WebKit2-4_0-2.18.5-8.1
typelib-1_0-WebKit2WebExtension-4_0-2.18.5-8.1
webkit-jsc-4-2.18.5-8.1
webkit-jsc-4-debuginfo-2.18.5-8.1
webkit2gtk-4_0-injected-bundles-2.18.5-8.1
webkit2gtk-4_0-injected-bundles-debuginfo-2.18.5-8.1
webkit2gtk3-debugsource-2.18.5-8.1
webkit2gtk3-devel-2.18.5-8.1
webkit2gtk3-plugin-process-gtk2-2.18.5-8.1
webkit2gtk3-plugin-process-gtk2-debuginfo-2.18.5-8.1

- openSUSE Leap 42.3 (x86_64):

libjavascriptcoregtk-4_0-18-32bit-2.18.5-8.1
libjavascriptcoregtk-4_0-18-debuginfo-32bit-2.18.5-8.1
libwebkit2gtk-4_0-37-32bit-2.18.5-8.1
libwebkit2gtk-4_0-37-debuginfo-32bit-2.18.5-8.1

- openSUSE Leap 42.3 (noarch):

libwebkit2gtk3-lang-2.18.5-8.1


References:

https://www.suse.com/security/cve/CVE-2016-4692.html
https://www.suse.com/security/cve/CVE-2016-4743.html
https://www.suse.com/security/cve/CVE-2016-7586.html
https://www.suse.com/security/cve/CVE-2016-7587.html
https://www.suse.com/security/cve/CVE-2016-7589.html
https://www.suse.com/security/cve/CVE-2016-7592.html
https://www.suse.com/security/cve/CVE-2016-7598.html
https://www.suse.com/security/cve/CVE-2016-7599.html
https://www.suse.com/security/cve/CVE-2016-7610.html
https://www.suse.com/security/cve/CVE-2016-7623.html
https://www.suse.com/security/cve/CVE-2016-7632.html
https://www.suse.com/security/cve/CVE-2016-7635.html
https://www.suse.com/security/cve/CVE-2016-7639.html
https://www.suse.com/security/cve/CVE-2016-7641.html
https://www.suse.com/security/cve/CVE-2016-7645.html
https://www.suse.com/security/cve/CVE-2016-7652.html
https://www.suse.com/security/cve/CVE-2016-7654.html
https://www.suse.com/security/cve/CVE-2016-7656.html
https://www.suse.com/security/cve/CVE-2017-13788.html
https://www.suse.com/security/cve/CVE-2017-13798.html
https://www.suse.com/security/cve/CVE-2017-13803.html
https://www.suse.com/security/cve/CVE-2017-13856.html
https://www.suse.com/security/cve/CVE-2017-13866.html
https://www.suse.com/security/cve/CVE-2017-13870.html
https://www.suse.com/security/cve/CVE-2017-2350.html
https://www.suse.com/security/cve/CVE-2017-2354.html
https://www.suse.com/security/cve/CVE-2017-2355.html
https://www.suse.com/security/cve/CVE-2017-2356.html
https://www.suse.com/security/cve/CVE-2017-2362.html
https://www.suse.com/security/cve/CVE-2017-2363.html
https://www.suse.com/security/cve/CVE-2017-2364.html
https://www.suse.com/security/cve/CVE-2017-2365.html
https://www.suse.com/security/cve/CVE-2017-2366.html
https://www.suse.com/security/cve/CVE-2017-2369.html
https://www.suse.com/security/cve/CVE-2017-2371.html
https://www.suse.com/security/cve/CVE-2017-2373.html
https://www.suse.com/security/cve/CVE-2017-2496.html
https://www.suse.com/security/cve/CVE-2017-2510.html
https://www.suse.com/security/cve/CVE-2017-2539.html
https://www.suse.com/security/cve/CVE-2017-5715.html
https://www.suse.com/security/cve/CVE-2017-5753.html
https://www.suse.com/security/cve/CVE-2017-5754.html
https://www.suse.com/security/cve/CVE-2017-7006.html
https://www.suse.com/security/cve/CVE-2017-7011.html
https://www.suse.com/security/cve/CVE-2017-7012.html
https://www.suse.com/security/cve/CVE-2017-7018.html
https://www.suse.com/security/cve/CVE-2017-7019.html
https://www.suse.com/security/cve/CVE-2017-7020.html
https://www.suse.com/security/cve/CVE-2017-7030.html
https://www.suse.com/security/cve/CVE-2017-7034.html
https://www.suse.com/security/cve/CVE-2017-7037.html
https://www.suse.com/security/cve/CVE-2017-7038.html
https://www.suse.com/security/cve/CVE-2017-7039.html
https://www.suse.com/security/cve/CVE-2017-7040.html
https://www.suse.com/security/cve/CVE-2017-7041.html
https://www.suse.com/security/cve/CVE-2017-7042.html
https://www.suse.com/security/cve/CVE-2017-7043.html
https://www.suse.com/security/cve/CVE-2017-7046.html
https://www.suse.com/security/cve/CVE-2017-7048.html
https://www.suse.com/security/cve/CVE-2017-7049.html
https://www.suse.com/security/cve/CVE-2017-7052.html
https://www.suse.com/security/cve/CVE-2017-7055.html
https://www.suse.com/security/cve/CVE-2017-7056.html
https://www.suse.com/security/cve/CVE-2017-7059.html
https://www.suse.com/security/cve/CVE-2017-7061.html
https://www.suse.com/security/cve/CVE-2017-7064.html
https://www.suse.com/security/cve/CVE-2017-7081.html
https://www.suse.com/security/cve/CVE-2017-7087.html
https://www.suse.com/security/cve/CVE-2017-7089.html
https://www.suse.com/security/cve/CVE-2017-7090.html
https://www.suse.com/security/cve/CVE-2017-7091.html
https://www.suse.com/security/cve/CVE-2017-7092.html
https://www.suse.com/security/cve/CVE-2017-7093.html
https://www.suse.com/security/cve/CVE-2017-7094.html
https://www.suse.com/security/cve/CVE-2017-7095.html
https://www.suse.com/security/cve/CVE-2017-7096.html
https://www.suse.com/security/cve/CVE-2017-7098.html
https://www.suse.com/security/cve/CVE-2017-7099.html
https://www.suse.com/security/cve/CVE-2017-7100.html
https://www.suse.com/security/cve/CVE-2017-7102.html
https://www.suse.com/security/cve/CVE-2017-7104.html
https://www.suse.com/security/cve/CVE-2017-7107.html
https://www.suse.com/security/cve/CVE-2017-7109.html
https://www.suse.com/security/cve/CVE-2017-7111.html
https://www.suse.com/security/cve/CVE-2017-7117.html
https://www.suse.com/security/cve/CVE-2017-7120.html
https://www.suse.com/security/cve/CVE-2017-7142.html
https://www.suse.com/security/cve/CVE-2017-7156.html
https://www.suse.com/security/cve/CVE-2017-7157.html
https://bugzilla.suse.com/1020950
https://bugzilla.suse.com/1024749
https://bugzilla.suse.com/1050469
https://bugzilla.suse.com/1066892
https://bugzilla.suse.com/1069925
https://bugzilla.suse.com/1073654
https://bugzilla.suse.com/1075419

--


openSUSE-SU-2018:0329-1: important: Security update for freeimage

openSUSE Security Update: Security update for freeimage
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:0329-1
Rating: important
References: #1002621
Cross-References: CVE-2016-5684
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for freeimage fixes one issues.

This security issue was fixed:

- CVE-2016-5684: Prevent out-of-bounds write vulnerability in the XMP
image handling functionality. A specially crafted XMP file could have
caused an arbitrary memory overwrite resulting in code execution
(boo#1002621).


Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-121=1

To bring your system up-to-date, use "zypper patch".


Package List:

- openSUSE Leap 42.3 (x86_64):

freeimage-debugsource-3.17.0-5.1
freeimage-devel-3.17.0-5.1
libfreeimage3-3.17.0-5.1
libfreeimage3-debuginfo-3.17.0-5.1
libfreeimageplus3-3.17.0-5.1
libfreeimageplus3-debuginfo-3.17.0-5.1


References:

https://www.suse.com/security/cve/CVE-2016-5684.html
https://bugzilla.suse.com/1002621

--


KRB5/Chromium-Browser Updates for Debian

RHN-Client-Tools/TzData Updates for Oracle Linux

Windows

Linux

macOS

Community

  • dhamu
    Hello Phil, I have a Linux Tutorial website that curre ...
  • StephanX
    Hi friends, i am new in the Linux universe but i try to ...
  • Philipp
    I would try the XanMod kernel: https://xanmod.org  I ...