The following updates has been released for SUSE:

openSUSE-SU-2018:3998-1: moderate: Security update for dom4j
openSUSE-SU-2018:3999-1: moderate: Security update for nextcloud
openSUSE-SU-2018:4002-1: moderate: Security update for nextcloud
openSUSE-SU-2018:4003-1: moderate: Security update for dpdk
openSUSE-SU-2018:4004-1: important: Security update for qemu
openSUSE-SU-2018:4005-1: moderate: Security update for glib2
openSUSE-SU-2018:4007-1: important: Security update for postgresql94

openSUSE-SU-2018:3998-1: moderate: Security update for dom4j

openSUSE Security Update: Security update for dom4j
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:3998-1
Rating: moderate
References: #1105443
Cross-References: CVE-2018-1000632
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for dom4j fixes the following issues:

- CVE-2018-1000632: Prevent XML injection that could have resulted in an
attacker tampering with XML documents (bsc#1105443).

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-1486=1



Package List:

- openSUSE Leap 15.0 (noarch):

dom4j-1.6.1-lp150.3.3.1
dom4j-demo-1.6.1-lp150.3.3.1
dom4j-javadoc-1.6.1-lp150.3.3.1
dom4j-manual-1.6.1-lp150.3.3.1


References:

https://www.suse.com/security/cve/CVE-2018-1000632.html
https://bugzilla.suse.com/1105443

--

openSUSE-SU-2018:3999-1: moderate: Security update for nextcloud

openSUSE Security Update: Security update for nextcloud
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:3999-1
Rating: moderate
References: #1114817
Cross-References: CVE-2018-3780
Affected Products:
SUSE Package Hub for SUSE Linux Enterprise 12
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for nextcloud fixes security issues and bugs.

Security issues fixed:

- CVE-2018-3780: Stored XSS in autocomplete suggestions for file comments
(boo#1114817)

This update also contains all bug fixes and improvements in the 13.0.8
version, including:

- Password expiration time changed from 12h to 7d
- Bug fixes to the OAuth brute force protection
- Various other bug fixes and improvements


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- SUSE Package Hub for SUSE Linux Enterprise 12:

zypper in -t patch openSUSE-2018-1487=1



Package List:

- SUSE Package Hub for SUSE Linux Enterprise 12 (noarch):

nextcloud-13.0.8-8.1


References:

https://www.suse.com/security/cve/CVE-2018-3780.html
https://bugzilla.suse.com/1114817

--

openSUSE-SU-2018:4002-1: moderate: Security update for nextcloud

openSUSE Security Update: Security update for nextcloud
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:4002-1
Rating: moderate
References: #1114817
Cross-References: CVE-2018-3780
Affected Products:
openSUSE Leap 42.3
openSUSE Leap 15.0
openSUSE Backports SLE-15
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for nextcloud fixes security issues and bugs.

Security issues fixed:

- CVE-2018-3780: Stored XSS in autocomplete suggestions for file comments
(boo#1114817)

This update also contains all bug fixes and improvements in the 13.0.8
version, including:

- Password expiration time changed from 12h to 7d
- Bug fixes to the OAuth brute force protection
- Various other bug fixes and improvements


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-1487=1

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-1487=1

- openSUSE Backports SLE-15:

zypper in -t patch openSUSE-2018-1487=1



Package List:

- openSUSE Leap 42.3 (noarch):

nextcloud-13.0.8-15.1

- openSUSE Leap 15.0 (noarch):

nextcloud-13.0.8-lp150.2.9.1

- openSUSE Backports SLE-15 (noarch):

nextcloud-13.0.8-bp150.2.6.1


References:

https://www.suse.com/security/cve/CVE-2018-3780.html
https://bugzilla.suse.com/1114817

--

openSUSE-SU-2018:4003-1: moderate: Security update for dpdk

openSUSE Security Update: Security update for dpdk
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:4003-1
Rating: moderate
References: #1069601 #1073363 #1089638 #1102310
Cross-References: CVE-2018-1059
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that solves one vulnerability and has three fixes
is now available.

Description:



This update for dpdk to version 16.11.8 provides the following security
fix:

- CVE-2018-1059: restrict untrusted guest to misuse virtio to corrupt host
application (ovs-dpdk) memory which could have lead all VM to lose
connectivity (bsc#1089638)

and following non-security fixes:

- Enable the broadcom chipset family Broadcom NetXtreme II BCM57810
(bsc#1073363)
- Fix a latency problem by using cond_resched rather than
schedule_timeout_interruptible (bsc#1069601)
- Fix a syntax error affecting csh environment configuration (bsc#1102310)
- Fixes in net/bnxt:
* Fix HW Tx checksum offload check
* Fix incorrect IO address handling in Tx
* Fix Rx ring count limitation
* Check access denied for HWRM commands
* Fix RETA size
* Fix close operation
- Fixes in eal/linux:
* Fix an invalid syntax in interrupts
* Fix return codes on thread naming failure
- Fixes in kni:
* Fix crash with null name
* Fix build with gcc 8.1
- Fixes in net/thunderx:
* Fix build with gcc optimization on
* Avoid sq door bell write on zero packet
- net/bonding: Fix MAC address reset
- vhost: Fix missing increment of log cache count

This update was imported from the SUSE:SLE-12-SP3:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-1484=1



Package List:

- openSUSE Leap 42.3 (i586 x86_64):

dpdk-16.11.8-6.8.1
dpdk-debuginfo-16.11.8-6.8.1
dpdk-debugsource-16.11.8-6.8.1
dpdk-devel-16.11.8-6.8.1
dpdk-devel-debuginfo-16.11.8-6.8.1
dpdk-examples-16.11.8-6.8.1
dpdk-examples-debuginfo-16.11.8-6.8.1
dpdk-tools-16.11.8-6.8.1

- openSUSE Leap 42.3 (x86_64):

dpdk-kmp-default-16.11.8_k4.4.162_78-6.8.1
dpdk-kmp-default-debuginfo-16.11.8_k4.4.162_78-6.8.1

- openSUSE Leap 42.3 (noarch):

dpdk-doc-16.11.8-6.8.1


References:

https://www.suse.com/security/cve/CVE-2018-1059.html
https://bugzilla.suse.com/1069601
https://bugzilla.suse.com/1073363
https://bugzilla.suse.com/1089638
https://bugzilla.suse.com/1102310

--

openSUSE-SU-2018:4004-1: important: Security update for qemu

openSUSE Security Update: Security update for qemu
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:4004-1
Rating: important
References: #1106222 #1107489 #1110910 #1111006 #1111010
#1111013 #1112499 #1114422 #1114529
Cross-References: CVE-2018-10839 CVE-2018-15746 CVE-2018-16847
CVE-2018-17958 CVE-2018-17962 CVE-2018-17963
CVE-2018-18849
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that solves 7 vulnerabilities and has two fixes
is now available.

Description:

This update for qemu fixes the following issues:

Security issues fixed:

- CVE-2018-10839: Fixed NE2000 NIC emulation support that is vulnerable to
an integer overflow, which could lead to buffer overflow issue. It could
occur when receiving packets over the network. A user inside guest could
use this flaw to crash the Qemu process resulting in DoS (bsc#1110910).
- CVE-2018-15746: Fixed qemu-seccomp.c that might allow local OS guest
users to cause a denial of service (guest crash) by leveraging
mishandling of the seccomp policy for threads other than the main thread
(bsc#1106222).
- CVE-2018-16847: Fixed an OOB heap buffer r/w access issue that was found
in the NVM Express Controller emulation in QEMU. It could occur in
nvme_cmb_ops routines in nvme device. A guest user/process could use
this flaw to crash the QEMU process resulting in DoS or potentially run
arbitrary code with privileges of the QEMU process (bsc#1114529).
- CVE-2018-17958: Fixed a Buffer Overflow in rtl8139_do_receive in
hw/net/rtl8139.c because an incorrect integer data type is used
(bsc#1111006).
- CVE-2018-17962: Fixed a Buffer Overflow in pcnet_receive in
hw/net/pcnet.c because an incorrect integer data type is used
(bsc#1111010).
- CVE-2018-17963: Fixed qemu_deliver_packet_iov in net/net.c that accepts
packet sizes greater than INT_MAX, which allows attackers to cause a
denial of service or possibly have unspecified other impact.
(bsc#1111013)
- CVE-2018-18849: Fixed an out of bounds memory access issue that was
found in the LSI53C895A SCSI Host Bus Adapter emulation while writing a
message in lsi_do_msgin. It could occur during migration if the
'msg_len' field has an invalid value. A user/process could use this flaw
to crash the Qemu process resulting in DoS (bsc#1114422).

Non-security issues fixed:

- Fix slowness in arm32 emulation (bsc#1112499).
- In order to improve spectre mitigation for s390x, add a new feature in
the QEMU cpu model to provide the etoken cpu feature for guests
(bsc#1107489).

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-1483=1



Package List:

- openSUSE Leap 15.0 (noarch):

qemu-ipxe-1.0.0+-lp150.7.12.1
qemu-seabios-1.11.0-lp150.7.12.1
qemu-sgabios-8-lp150.7.12.1
qemu-vgabios-1.11.0-lp150.7.12.1

- openSUSE Leap 15.0 (x86_64):

qemu-2.11.2-lp150.7.12.1
qemu-arm-2.11.2-lp150.7.12.1
qemu-arm-debuginfo-2.11.2-lp150.7.12.1
qemu-block-curl-2.11.2-lp150.7.12.1
qemu-block-curl-debuginfo-2.11.2-lp150.7.12.1
qemu-block-dmg-2.11.2-lp150.7.12.1
qemu-block-dmg-debuginfo-2.11.2-lp150.7.12.1
qemu-block-gluster-2.11.2-lp150.7.12.1
qemu-block-gluster-debuginfo-2.11.2-lp150.7.12.1
qemu-block-iscsi-2.11.2-lp150.7.12.1
qemu-block-iscsi-debuginfo-2.11.2-lp150.7.12.1
qemu-block-rbd-2.11.2-lp150.7.12.1
qemu-block-rbd-debuginfo-2.11.2-lp150.7.12.1
qemu-block-ssh-2.11.2-lp150.7.12.1
qemu-block-ssh-debuginfo-2.11.2-lp150.7.12.1
qemu-debuginfo-2.11.2-lp150.7.12.1
qemu-debugsource-2.11.2-lp150.7.12.1
qemu-extra-2.11.2-lp150.7.12.1
qemu-extra-debuginfo-2.11.2-lp150.7.12.1
qemu-guest-agent-2.11.2-lp150.7.12.1
qemu-guest-agent-debuginfo-2.11.2-lp150.7.12.1
qemu-ksm-2.11.2-lp150.7.12.1
qemu-kvm-2.11.2-lp150.7.12.1
qemu-lang-2.11.2-lp150.7.12.1
qemu-linux-user-2.11.2-lp150.7.12.1
qemu-linux-user-debuginfo-2.11.2-lp150.7.12.1
qemu-linux-user-debugsource-2.11.2-lp150.7.12.1
qemu-ppc-2.11.2-lp150.7.12.1
qemu-ppc-debuginfo-2.11.2-lp150.7.12.1
qemu-s390-2.11.2-lp150.7.12.1
qemu-s390-debuginfo-2.11.2-lp150.7.12.1
qemu-testsuite-2.11.2-lp150.7.12.1
qemu-tools-2.11.2-lp150.7.12.1
qemu-tools-debuginfo-2.11.2-lp150.7.12.1
qemu-x86-2.11.2-lp150.7.12.1
qemu-x86-debuginfo-2.11.2-lp150.7.12.1


References:

https://www.suse.com/security/cve/CVE-2018-10839.html
https://www.suse.com/security/cve/CVE-2018-15746.html
https://www.suse.com/security/cve/CVE-2018-16847.html
https://www.suse.com/security/cve/CVE-2018-17958.html
https://www.suse.com/security/cve/CVE-2018-17962.html
https://www.suse.com/security/cve/CVE-2018-17963.html
https://www.suse.com/security/cve/CVE-2018-18849.html
https://bugzilla.suse.com/1106222
https://bugzilla.suse.com/1107489
https://bugzilla.suse.com/1110910
https://bugzilla.suse.com/1111006
https://bugzilla.suse.com/1111010
https://bugzilla.suse.com/1111013
https://bugzilla.suse.com/1112499
https://bugzilla.suse.com/1114422
https://bugzilla.suse.com/1114529

--

openSUSE-SU-2018:4005-1: moderate: Security update for glib2

openSUSE Security Update: Security update for glib2
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:4005-1
Rating: moderate
References: #1107116 #1107121 #1111499
Cross-References: CVE-2018-16428 CVE-2018-16429
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that solves two vulnerabilities and has one
errata is now available.

Description:

This update for glib2 fixes the following issues:

Security issues fixed:

- CVE-2018-16428: Do not do a NULL pointer dereference (crash). Avoid
that, at the cost of introducing a new translatable error message
(bsc#1107121).
- CVE-2018-16429: Fixed out-of-bounds read vulnerability
ing_markup_parse_context_parse() (bsc#1107116).

Non-security issue fixed:

- various GVariant parsing issues have been resolved (bsc#1111499)

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-1485=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

glib2-debugsource-2.54.3-lp150.3.3.1
glib2-devel-2.54.3-lp150.3.3.1
glib2-devel-debuginfo-2.54.3-lp150.3.3.1
glib2-devel-static-2.54.3-lp150.3.3.1
glib2-tools-2.54.3-lp150.3.3.1
glib2-tools-debuginfo-2.54.3-lp150.3.3.1
libgio-2_0-0-2.54.3-lp150.3.3.1
libgio-2_0-0-debuginfo-2.54.3-lp150.3.3.1
libgio-fam-2.54.3-lp150.3.3.1
libgio-fam-debuginfo-2.54.3-lp150.3.3.1
libglib-2_0-0-2.54.3-lp150.3.3.1
libglib-2_0-0-debuginfo-2.54.3-lp150.3.3.1
libgmodule-2_0-0-2.54.3-lp150.3.3.1
libgmodule-2_0-0-debuginfo-2.54.3-lp150.3.3.1
libgobject-2_0-0-2.54.3-lp150.3.3.1
libgobject-2_0-0-debuginfo-2.54.3-lp150.3.3.1
libgthread-2_0-0-2.54.3-lp150.3.3.1
libgthread-2_0-0-debuginfo-2.54.3-lp150.3.3.1

- openSUSE Leap 15.0 (x86_64):

glib2-devel-32bit-2.54.3-lp150.3.3.1
glib2-devel-32bit-debuginfo-2.54.3-lp150.3.3.1
glib2-tools-32bit-2.54.3-lp150.3.3.1
glib2-tools-32bit-debuginfo-2.54.3-lp150.3.3.1
libgio-2_0-0-32bit-2.54.3-lp150.3.3.1
libgio-2_0-0-32bit-debuginfo-2.54.3-lp150.3.3.1
libgio-fam-32bit-2.54.3-lp150.3.3.1
libgio-fam-32bit-debuginfo-2.54.3-lp150.3.3.1
libglib-2_0-0-32bit-2.54.3-lp150.3.3.1
libglib-2_0-0-32bit-debuginfo-2.54.3-lp150.3.3.1
libgmodule-2_0-0-32bit-2.54.3-lp150.3.3.1
libgmodule-2_0-0-32bit-debuginfo-2.54.3-lp150.3.3.1
libgobject-2_0-0-32bit-2.54.3-lp150.3.3.1
libgobject-2_0-0-32bit-debuginfo-2.54.3-lp150.3.3.1
libgthread-2_0-0-32bit-2.54.3-lp150.3.3.1
libgthread-2_0-0-32bit-debuginfo-2.54.3-lp150.3.3.1

- openSUSE Leap 15.0 (noarch):

gio-branding-upstream-2.54.3-lp150.3.3.1
glib2-lang-2.54.3-lp150.3.3.1


References:

https://www.suse.com/security/cve/CVE-2018-16428.html
https://www.suse.com/security/cve/CVE-2018-16429.html
https://bugzilla.suse.com/1107116
https://bugzilla.suse.com/1107121
https://bugzilla.suse.com/1111499

--

openSUSE-SU-2018:4007-1: important: Security update for postgresql94

openSUSE Security Update: Security update for postgresql94
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:4007-1
Rating: important
References: #1104199
Cross-References: CVE-2018-10915
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for postgresql94 to 9.4.19 fixes the following security issue:

- CVE-2018-10915: libpq failed to properly reset its internal state
between connections. If an affected version of libpq was used with
"host" or "hostaddr" connection parameters from untrusted input,
attackers could have bypassed client-side connection security features,
obtain access to higher privileged connections or potentially cause
other impact SQL injection, by causing the PQescape() functions to
malfunction (bsc#1104199).

A dump/restore is not required for this update unless you use the
functions query_to_xml, cursor_to_xml, cursor_to_xmlschema,
query_to_xmlschema, and query_to_xml_and_xmlschema. In this case please
see the first entry of
https://www.postgresql.org/docs/9.4/static/release-9-4-18.html

This update was imported from the SUSE:SLE-12:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-1482=1



Package List:

- openSUSE Leap 42.3 (i586 x86_64):

postgresql94-9.4.19-24.1
postgresql94-contrib-9.4.19-24.1
postgresql94-contrib-debuginfo-9.4.19-24.1
postgresql94-debuginfo-9.4.19-24.1
postgresql94-debugsource-9.4.19-24.1
postgresql94-devel-9.4.19-24.1
postgresql94-devel-debuginfo-9.4.19-24.1
postgresql94-libs-debugsource-9.4.19-24.1
postgresql94-plperl-9.4.19-24.1
postgresql94-plperl-debuginfo-9.4.19-24.1
postgresql94-plpython-9.4.19-24.1
postgresql94-plpython-debuginfo-9.4.19-24.1
postgresql94-pltcl-9.4.19-24.1
postgresql94-pltcl-debuginfo-9.4.19-24.1
postgresql94-server-9.4.19-24.1
postgresql94-server-debuginfo-9.4.19-24.1
postgresql94-test-9.4.19-24.1

- openSUSE Leap 42.3 (noarch):

postgresql94-docs-9.4.19-24.1


References:

https://www.suse.com/security/cve/CVE-2018-10915.html
https://bugzilla.suse.com/1104199

--