The following security update has been released for openSUSE Leap:
openSUSE-SU-2018:0734-1: important: Security update for SDL2, SDL2_image
openSUSE-SU-2018:0737-1: important: Security update for MozillaFirefox
openSUSE-SU-2018:0734-1: important: Security update for SDL2, SDL2_image
openSUSE-SU-2018:0737-1: important: Security update for MozillaFirefox
openSUSE-SU-2018:0734-1: important: Security update for SDL2, SDL2_image
openSUSE Security Update: Security update for SDL2, SDL2_image
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:0734-1
Rating: important
References: #1025413 #1084256 #1084257 #1084282 #1084288
#1084297 #1084303 #1084304
Cross-References: CVE-2017-12122 CVE-2017-14440 CVE-2017-14441
CVE-2017-14442 CVE-2017-14448 CVE-2017-14449
CVE-2017-14450
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________
An update that solves 7 vulnerabilities and has one errata
is now available.
Description:
This update for SDL2 and SDL2_image fixes the following issues:
- CVE-2017-14441: Code execution in the ICO image rendering (bsc#1084282).
- CVE-2017-14440: Potential code execution in the ILBM image rendering
functionality (bsc#1084257).
- CVE-2017-12122: Potential code execution in the ILBM image rendering
fuctionality (bsc#1084256).
- CVE-2017-14448: Heap buffer overflow in the XCF image rendering
functionality (bsc#1084303).
- CVE-2017-14449: Double-Free in the XCF image rendering (bsc#1084297).
- CVE-2017-14442: Stack buffer overflow the BMP image rendering
functionality (bsc#1084304).
- CVE-2017-14450: Buffer overflow in the GIF image parsing (bsc#1084288).
Bug fixes:
- boo#1025413: Add dbus-ime.diff and build with fcitx.
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2018-280=1
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE Leap 42.3 (i586 x86_64):
SDL2-debugsource-2.0.8-18.1
SDL2_image-debugsource-2.0.3-13.10.1
libSDL2-2_0-0-2.0.8-18.1
libSDL2-2_0-0-debuginfo-2.0.8-18.1
libSDL2-devel-2.0.8-18.1
libSDL2_image-2_0-0-2.0.3-13.10.1
libSDL2_image-2_0-0-debuginfo-2.0.3-13.10.1
libSDL2_image-devel-2.0.3-13.10.1
- openSUSE Leap 42.3 (x86_64):
libSDL2-2_0-0-32bit-2.0.8-18.1
libSDL2-2_0-0-debuginfo-32bit-2.0.8-18.1
libSDL2-devel-32bit-2.0.8-18.1
libSDL2_image-2_0-0-32bit-2.0.3-13.10.1
libSDL2_image-2_0-0-debuginfo-32bit-2.0.3-13.10.1
libSDL2_image-devel-32bit-2.0.3-13.10.1
References:
https://www.suse.com/security/cve/CVE-2017-12122.html
https://www.suse.com/security/cve/CVE-2017-14440.html
https://www.suse.com/security/cve/CVE-2017-14441.html
https://www.suse.com/security/cve/CVE-2017-14442.html
https://www.suse.com/security/cve/CVE-2017-14448.html
https://www.suse.com/security/cve/CVE-2017-14449.html
https://www.suse.com/security/cve/CVE-2017-14450.html
https://bugzilla.suse.com/1025413
https://bugzilla.suse.com/1084256
https://bugzilla.suse.com/1084257
https://bugzilla.suse.com/1084282
https://bugzilla.suse.com/1084288
https://bugzilla.suse.com/1084297
https://bugzilla.suse.com/1084303
https://bugzilla.suse.com/1084304
--
openSUSE-SU-2018:0737-1: important: Security update for MozillaFirefox
openSUSE Security Update: Security update for MozillaFirefox
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:0737-1
Rating: important
References: #1085671
Cross-References: CVE-2018-5146
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for Mozilla Firefox to version 52.7.2esr fixes security issues
and bugs.
Security issues fixed:
- CVE-2018-5146: Specially crafted vorbis files could have been used to
execute arbitrary code via an Out of bounds memory write (bsc#1085671,
MFSA 2018-08)
- CVE-2018-5147: Specially crafted vorbis files could have been used to
execute arbitrary code via an Out of bounds memory write - used on ARM
platforms (bsc#1085671, MFSA 2018-08)
The following bug fixes are included:
- Stability improvements in the Italian locale
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2018-278=1
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE Leap 42.3 (x86_64):
MozillaFirefox-52.7.2-81.1
MozillaFirefox-branding-upstream-52.7.2-81.1
MozillaFirefox-buildsymbols-52.7.2-81.1
MozillaFirefox-debuginfo-52.7.2-81.1
MozillaFirefox-debugsource-52.7.2-81.1
MozillaFirefox-devel-52.7.2-81.1
MozillaFirefox-translations-common-52.7.2-81.1
MozillaFirefox-translations-other-52.7.2-81.1
References:
https://www.suse.com/security/cve/CVE-2018-5146.html
https://bugzilla.suse.com/1085671
--
