The following updates has been released for openSUSE:
openSUSE-SU-2018:1049-1: important: Security update for PackageKit
openSUSE-SU-2018:1051-1: important: Security update for hdf5
openSUSE-SU-2018:1056-1: important: Security update for hdf5
openSUSE-SU-2018:1057-1: important: Security update for virtualbox
openSUSE-SU-2018:1049-1: important: Security update for PackageKit
openSUSE-SU-2018:1051-1: important: Security update for hdf5
openSUSE-SU-2018:1056-1: important: Security update for hdf5
openSUSE-SU-2018:1057-1: important: Security update for virtualbox
openSUSE-SU-2018:1049-1: important: Security update for PackageKit
openSUSE Security Update: Security update for PackageKit
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:1049-1
Rating: important
References: #1086936
Cross-References: CVE-2018-1106
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for PackageKit fixes the following security issue:
- CVE-2018-1106: Drop the polkit rule which could allow users in wheel
group to install packages without root password (bsc#1086936).
This update was imported from the SUSE:SLE-12-SP2:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2018-386=1
Package List:
- openSUSE Leap 42.3 (i586 x86_64):
PackageKit-1.1.3-5.3.1
PackageKit-backend-zypp-1.1.3-5.3.1
PackageKit-backend-zypp-debuginfo-1.1.3-5.3.1
PackageKit-debuginfo-1.1.3-5.3.1
PackageKit-debugsource-1.1.3-5.3.1
PackageKit-devel-1.1.3-5.3.1
PackageKit-devel-debuginfo-1.1.3-5.3.1
PackageKit-gstreamer-plugin-1.1.3-5.3.1
PackageKit-gstreamer-plugin-debuginfo-1.1.3-5.3.1
PackageKit-gtk3-module-1.1.3-5.3.1
PackageKit-gtk3-module-debuginfo-1.1.3-5.3.1
libpackagekit-glib2-18-1.1.3-5.3.1
libpackagekit-glib2-18-debuginfo-1.1.3-5.3.1
libpackagekit-glib2-devel-1.1.3-5.3.1
typelib-1_0-PackageKitGlib-1_0-1.1.3-5.3.1
- openSUSE Leap 42.3 (x86_64):
libpackagekit-glib2-18-32bit-1.1.3-5.3.1
libpackagekit-glib2-18-debuginfo-32bit-1.1.3-5.3.1
libpackagekit-glib2-devel-32bit-1.1.3-5.3.1
- openSUSE Leap 42.3 (noarch):
PackageKit-branding-upstream-1.1.3-5.3.1
PackageKit-lang-1.1.3-5.3.1
References:
https://www.suse.com/security/cve/CVE-2018-1106.html
https://bugzilla.suse.com/1086936
openSUSE-SU-2018:1051-1: important: Security update for hdf5
openSUSE Security Update: Security update for hdf5
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:1051-1
Rating: important
References: #1011198 #1011201 #1011204 #1011205
Cross-References: CVE-2016-4330 CVE-2016-4331 CVE-2016-4332
CVE-2016-4333
Affected Products:
SUSE Package Hub for SUSE Linux Enterprise 12
______________________________________________________________________________
An update that fixes four vulnerabilities is now available.
Description:
This update for hdf5 fixes the following issues:
- fix security issues (arbitary code execution): CVE-2016-4330: H5T_ARRAY
Code Execution (boo#1011201) CVE-2016-4331: H5Z_NBIT Code Execution
(boo#1011204) CVE-2016-4332: Shareable Message Type Code Execution
(boo#1011205) CVE-2016-4333: Array index bounds issue (boo#1011198)
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE Package Hub for SUSE Linux Enterprise 12:
zypper in -t patch openSUSE-2018-392=1
Package List:
- SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64):
hdf5-1.8.17-5.1
hdf5-devel-1.8.17-5.1
hdf5-devel-data-1.8.17-5.1
hdf5-devel-static-1.8.17-5.1
hdf5-examples-1.8.17-5.1
hdf5-openmpi-1.8.17-5.1
hdf5-openmpi-devel-1.8.17-5.1
hdf5-openmpi-devel-static-1.8.17-5.1
libhdf5-10-1.8.17-5.1
libhdf5-10-openmpi-1.8.17-5.1
libhdf5_cpp12-1.8.17-5.1
libhdf5_fortran10-1.8.17-5.1
libhdf5_fortran10-openmpi-1.8.17-5.1
libhdf5_hl10-1.8.17-5.1
libhdf5_hl10-openmpi-1.8.17-5.1
libhdf5_hl_cpp11-1.8.17-5.1
libhdf5hl_fortran10-1.8.17-5.1
libhdf5hl_fortran10-openmpi-1.8.17-5.1
- SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 s390x x86_64):
hdf5-debuginfo-1.8.17-5.1
hdf5-debugsource-1.8.17-5.1
hdf5-openmpi-debuginfo-1.8.17-5.1
libhdf5-10-debuginfo-1.8.17-5.1
libhdf5-10-openmpi-debuginfo-1.8.17-5.1
libhdf5_cpp12-debuginfo-1.8.17-5.1
libhdf5_fortran10-debuginfo-1.8.17-5.1
libhdf5_fortran10-openmpi-debuginfo-1.8.17-5.1
libhdf5_hl10-debuginfo-1.8.17-5.1
libhdf5_hl10-openmpi-debuginfo-1.8.17-5.1
libhdf5_hl_cpp11-debuginfo-1.8.17-5.1
libhdf5hl_fortran10-debuginfo-1.8.17-5.1
libhdf5hl_fortran10-openmpi-debuginfo-1.8.17-5.1
References:
https://www.suse.com/security/cve/CVE-2016-4330.html
https://www.suse.com/security/cve/CVE-2016-4331.html
https://www.suse.com/security/cve/CVE-2016-4332.html
https://www.suse.com/security/cve/CVE-2016-4333.html
https://bugzilla.suse.com/1011198
https://bugzilla.suse.com/1011201
https://bugzilla.suse.com/1011204
https://bugzilla.suse.com/1011205
openSUSE-SU-2018:1056-1: important: Security update for hdf5
openSUSE Security Update: Security update for hdf5
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:1056-1
Rating: important
References: #1011198 #1011201 #1011204 #1011205
Cross-References: CVE-2016-4330 CVE-2016-4331 CVE-2016-4332
CVE-2016-4333
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________
An update that fixes four vulnerabilities is now available.
Description:
This update for hdf5 fixes the following issues:
- fix security issues (arbitary code execution): CVE-2016-4330: H5T_ARRAY
Code Execution (boo#1011201) CVE-2016-4331: H5Z_NBIT Code Execution
(boo#1011204) CVE-2016-4332: Shareable Message Type Code Execution
(boo#1011205) CVE-2016-4333: Array index bounds issue (boo#1011198)
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2018-392=1
Package List:
- openSUSE Leap 42.3 (x86_64):
hdf5-1.8.15-7.3.1
hdf5-debuginfo-1.8.15-7.3.1
hdf5-debugsource-1.8.15-7.3.1
hdf5-devel-1.8.15-7.3.1
hdf5-devel-data-1.8.15-7.3.1
hdf5-devel-static-1.8.15-7.3.1
hdf5-examples-1.8.15-7.3.1
hdf5-openmpi-1.8.15-7.3.1
hdf5-openmpi-debuginfo-1.8.15-7.3.1
hdf5-openmpi-devel-1.8.15-7.3.1
hdf5-openmpi-devel-static-1.8.15-7.3.1
libhdf5-10-1.8.15-7.3.1
libhdf5-10-debuginfo-1.8.15-7.3.1
libhdf5-10-openmpi-1.8.15-7.3.1
libhdf5-10-openmpi-debuginfo-1.8.15-7.3.1
libhdf5_hl10-1.8.15-7.3.1
libhdf5_hl10-debuginfo-1.8.15-7.3.1
libhdf5_hl10-openmpi-1.8.15-7.3.1
libhdf5_hl10-openmpi-debuginfo-1.8.15-7.3.1
References:
https://www.suse.com/security/cve/CVE-2016-4330.html
https://www.suse.com/security/cve/CVE-2016-4331.html
https://www.suse.com/security/cve/CVE-2016-4332.html
https://www.suse.com/security/cve/CVE-2016-4333.html
https://bugzilla.suse.com/1011198
https://bugzilla.suse.com/1011201
https://bugzilla.suse.com/1011204
https://bugzilla.suse.com/1011205
openSUSE-SU-2018:1057-1: important: Security update for virtualbox
openSUSE Security Update: Security update for virtualbox
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:1057-1
Rating: important
References: #1089997
Cross-References: CVE-2017-3737 CVE-2017-9798 CVE-2018-0739
CVE-2018-2830 CVE-2018-2831 CVE-2018-2835
CVE-2018-2836 CVE-2018-2837 CVE-2018-2842
CVE-2018-2843 CVE-2018-2844 CVE-2018-2845
CVE-2018-2860
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________
An update that fixes 13 vulnerabilities is now available.
Description:
This update for VirtualBox to version 5.1.36 fixes multiple issues:
Security issues fixed:
- CVE-2018-0739: Unauthorized remote attacker may have caused a hang or
frequently repeatable crash (complete DOS)
- CVE-2018-2830: Attacker with host login may have compromised Virtualbox
or further system services after interaction with a third user
- CVE-2018-2831: Attacker with host login may have compromised VirtualBox
or further system services, allowing read access to some data
- CVE-2018-2835: Attacker with host login may have gained control over
VirtualBox and possibly further system services after interacting with a
third user
- CVE-2018-2836: Attacker with host login may have gained control over
VirtualBox and possibly further system services after interacting with a
third user
- CVE-2018-2837: Attacker with host login may have gained control over
VirtualBox and possibly further system services after interacting with a
third user
- CVE-2018-2842: Attacker with host login may have gained control over
VirtualBox and possibly further system services after interacting with a
third user
- CVE-2018-2843: Attacker with host login may have gained control over
VirtualBox and possibly further system services after interacting with a
third user
- CVE-2018-2844: Attacker with host login may have gained control over
VirtualBox and possibly further system services after interacting with a
third user
- CVE-2018-2845: Attacker with host login may have caused a hang or
frequently repeatable crash (complete DOS), and perform unauthorized
read and write operation to some VirtualBox accessible data
- CVE-2018-2860: Privileged attacker may have gained control over
VirtualBox and possibly further system services
http://www.oracle.com/technetwork/security-advisory/cpuapr2018verbose-36781
08.html
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
#AppendixOVIR
This update also contains all upstream fixes and improvements in the
stable 5.1.36 release.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2018-389=1
Package List:
- openSUSE Leap 42.3 (noarch):
virtualbox-guest-desktop-icons-5.1.36-50.1
virtualbox-guest-source-5.1.36-50.1
virtualbox-host-source-5.1.36-50.1
- openSUSE Leap 42.3 (x86_64):
python-virtualbox-5.1.36-50.1
python-virtualbox-debuginfo-5.1.36-50.1
virtualbox-5.1.36-50.1
virtualbox-debuginfo-5.1.36-50.1
virtualbox-debugsource-5.1.36-50.1
virtualbox-devel-5.1.36-50.1
virtualbox-guest-kmp-default-5.1.36_k4.4.126_48-50.1
virtualbox-guest-kmp-default-debuginfo-5.1.36_k4.4.126_48-50.1
virtualbox-guest-tools-5.1.36-50.1
virtualbox-guest-tools-debuginfo-5.1.36-50.1
virtualbox-guest-x11-5.1.36-50.1
virtualbox-guest-x11-debuginfo-5.1.36-50.1
virtualbox-host-kmp-default-5.1.36_k4.4.126_48-50.1
virtualbox-host-kmp-default-debuginfo-5.1.36_k4.4.126_48-50.1
virtualbox-qt-5.1.36-50.1
virtualbox-qt-debuginfo-5.1.36-50.1
virtualbox-vnc-5.1.36-50.1
virtualbox-websrv-5.1.36-50.1
virtualbox-websrv-debuginfo-5.1.36-50.1
References:
https://www.suse.com/security/cve/CVE-2017-3737.html
https://www.suse.com/security/cve/CVE-2017-9798.html
https://www.suse.com/security/cve/CVE-2018-0739.html
https://www.suse.com/security/cve/CVE-2018-2830.html
https://www.suse.com/security/cve/CVE-2018-2831.html
https://www.suse.com/security/cve/CVE-2018-2835.html
https://www.suse.com/security/cve/CVE-2018-2836.html
https://www.suse.com/security/cve/CVE-2018-2837.html
https://www.suse.com/security/cve/CVE-2018-2842.html
https://www.suse.com/security/cve/CVE-2018-2843.html
https://www.suse.com/security/cve/CVE-2018-2844.html
https://www.suse.com/security/cve/CVE-2018-2845.html
https://www.suse.com/security/cve/CVE-2018-2860.html
https://bugzilla.suse.com/1089997
