The following updates has been released for openSUSE:
openSUSE-SU-2018:2229-1: important: Security update for libofx
openSUSE-SU-2018:2231-1: moderate: Security update for znc
openSUSE-SU-2018:2237-1: moderate: Security update for kernel-firmware
openSUSE-SU-2018:2238-1: moderate: Security update for ovmf
openSUSE-SU-2018:2239-1: moderate: Security update for cups
openSUSE-SU-2018:2241-1: moderate: Security update for libcgroup
openSUSE-SU-2018:2242-1: important: Security update for the Linux Kernel
openSUSE-SU-2018:2229-1: important: Security update for libofx
openSUSE-SU-2018:2231-1: moderate: Security update for znc
openSUSE-SU-2018:2237-1: moderate: Security update for kernel-firmware
openSUSE-SU-2018:2238-1: moderate: Security update for ovmf
openSUSE-SU-2018:2239-1: moderate: Security update for cups
openSUSE-SU-2018:2241-1: moderate: Security update for libcgroup
openSUSE-SU-2018:2242-1: important: Security update for the Linux Kernel
openSUSE-SU-2018:2229-1: important: Security update for libofx
openSUSE Security Update: Security update for libofx
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:2229-1
Rating: important
References: #1058673 #1061964
Cross-References: CVE-2017-2816 CVE-2017-2920
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________
An update that fixes two vulnerabilities is now available.
Description:
This update for libofx fixes the following issues:
The following security vulnerabilities have been addressed:
- CVE-2017-2920: Fixed an exploitable buffer overflow in the tag parsing
functionality, which could result in an out of bounds write and could be
triggered via a specially crafted OFX file (boo#1061964)
- CVE-2017-2816: Fixed another buffer overflow in the tag parsing
functionality, which could result in an stack overflow and could be
triggered via a specially crafted OFX file (boo#1058673)
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2018-820=1
Package List:
- openSUSE Leap 42.3 (i586 x86_64):
libofx-0.9.10-7.3.1
libofx-debuginfo-0.9.10-7.3.1
libofx-debugsource-0.9.10-7.3.1
libofx-devel-0.9.10-7.3.1
libofx6-0.9.10-7.3.1
libofx6-debuginfo-0.9.10-7.3.1
References:
https://www.suse.com/security/cve/CVE-2017-2816.html
https://www.suse.com/security/cve/CVE-2017-2920.html
https://bugzilla.suse.com/1058673
https://bugzilla.suse.com/1061964
--
openSUSE-SU-2018:2231-1: moderate: Security update for znc
openSUSE Security Update: Security update for znc
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:2231-1
Rating: moderate
References: #1101280 #1101281
Cross-References: CVE-2018-14055 CVE-2018-14056
Affected Products:
openSUSE Leap 42.3
openSUSE Leap 15.0
______________________________________________________________________________
An update that fixes two vulnerabilities is now available.
Description:
This update for znc fixes the following issues:
- Update to version 1.7.1
* CVE-2018-14055: non-admin user could gain admin privileges and shell
access by injecting values into znc.conf (bnc#1101281)
* CVE-2018-14056: path traversal in HTTP handler via ../ in a web skin
name. (bnc#1101280)
- Update to version 1.7.0
* Make ZNC UI translateable to different languages
* Configs written before ZNC 0.206 can't be read anymore
* Implement IRCv3.2 capabilities away-notify, account-notify,
extended-join
* Implement IRCv3.2 capabilities echo-message, cap-notify on the "client
side"
* Update capability names as they are named in IRCv3.2:
znc.in/server-time-isoâserver-time, znc.in/batchâbatch. Old names
will continue working for a while, then will be removed in some future
version.
* Make ZNC request server-time from server when available
* Add "AuthOnlyViaModule" global/user setting
* Stop defaulting real name to "Got ZNC?"
* Add SNI SSL client support
* Add support for CIDR notation in allowed hosts list and in trusted
proxy list
* Add network-specific config for cert validation in addition to
user-supplied fingerprints: TrustAllCerts, defaults to false, and
TrustPKI, defaults to true.
* Add /attach command for symmetry with /detach. Unlike /join it allows
wildcards.
- Update to version 1.6.6:
* Fix use-after-free in znc --makepem. It was broken for a long time,
but started segfaulting only now. This is a useability fix, not a
security fix, because self-signed (or signed by a CA) certificates can
be created without using --makepem, and then combined into znc.pem.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2018-819=1
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2018-819=1
Package List:
- openSUSE Leap 42.3 (i586 x86_64):
znc-1.7.1-20.3.1
znc-debuginfo-1.7.1-20.3.1
znc-debugsource-1.7.1-20.3.1
znc-devel-1.7.1-20.3.1
znc-perl-1.7.1-20.3.1
znc-perl-debuginfo-1.7.1-20.3.1
znc-python3-1.7.1-20.3.1
znc-python3-debuginfo-1.7.1-20.3.1
znc-tcl-1.7.1-20.3.1
znc-tcl-debuginfo-1.7.1-20.3.1
- openSUSE Leap 42.3 (noarch):
znc-lang-1.7.1-20.3.1
- openSUSE Leap 15.0 (x86_64):
znc-1.7.1-lp150.2.6.1
znc-debuginfo-1.7.1-lp150.2.6.1
znc-debugsource-1.7.1-lp150.2.6.1
znc-devel-1.7.1-lp150.2.6.1
znc-perl-1.7.1-lp150.2.6.1
znc-perl-debuginfo-1.7.1-lp150.2.6.1
znc-python3-1.7.1-lp150.2.6.1
znc-python3-debuginfo-1.7.1-lp150.2.6.1
znc-tcl-1.7.1-lp150.2.6.1
znc-tcl-debuginfo-1.7.1-lp150.2.6.1
- openSUSE Leap 15.0 (noarch):
znc-lang-1.7.1-lp150.2.6.1
References:
https://www.suse.com/security/cve/CVE-2018-14055.html
https://www.suse.com/security/cve/CVE-2018-14056.html
https://bugzilla.suse.com/1101280
https://bugzilla.suse.com/1101281
--
openSUSE-SU-2018:2237-1: moderate: Security update for kernel-firmware
openSUSE Security Update: Security update for kernel-firmware
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:2237-1
Rating: moderate
References: #1095735
Cross-References: CVE-2017-5715
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for kernel-firmware to version 20180525 fixes the following
issues:
This security issue was fixed:
- CVE-2017-5715: Prevent unauthorized disclosure of information to an
attacker with local user access caused by speculative execution and
indirect branch prediction (bsc#1095735)
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2018-825=1
Package List:
- openSUSE Leap 15.0 (noarch):
kernel-firmware-20180525-lp150.2.3.1
ucode-amd-20180525-lp150.2.3.1
References:
https://www.suse.com/security/cve/CVE-2017-5715.html
https://bugzilla.suse.com/1095735
--
openSUSE-SU-2018:2238-1: moderate: Security update for ovmf
openSUSE Security Update: Security update for ovmf
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:2238-1
Rating: moderate
References: #1077330 #1094290 #1094291
Cross-References: CVE-2018-0739
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________
An update that solves one vulnerability and has two fixes
is now available.
Description:
This update for ovmf provide the following fix:
Security issues fixed:
- CVE-2018-0739: Update openssl to 1.0.2o to limit ASN.1 constructed types
recursive definition depth (bsc#1094290, bsc#1094291).
Bug fixes:
- Only use SLES-UEFI-CA-Certificate-2048.crt for the SUSE flavor to
provide the better compatibility. (bsc#1077330)
This update was imported from the SUSE:SLE-12-SP3:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2018-823=1
Package List:
- openSUSE Leap 42.3 (i586 x86_64):
ovmf-2017+git1492060560.b6d11d7c46-10.1
ovmf-tools-2017+git1492060560.b6d11d7c46-10.1
- openSUSE Leap 42.3 (x86_64):
qemu-ovmf-x86_64-debug-2017+git1492060560.b6d11d7c46-10.1
- openSUSE Leap 42.3 (noarch):
qemu-ovmf-ia32-2017+git1492060560.b6d11d7c46-10.1
qemu-ovmf-x86_64-2017+git1492060560.b6d11d7c46-10.1
References:
https://www.suse.com/security/cve/CVE-2018-0739.html
https://bugzilla.suse.com/1077330
https://bugzilla.suse.com/1094290
https://bugzilla.suse.com/1094291
--
openSUSE-SU-2018:2239-1: moderate: Security update for cups
openSUSE Security Update: Security update for cups
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:2239-1
Rating: moderate
References: #1050082 #1061066 #1087018 #1096405 #1096406
#1096407 #1096408
Cross-References: CVE-2017-18248 CVE-2018-4180 CVE-2018-4181
CVE-2018-4182 CVE-2018-4183
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________
An update that solves 5 vulnerabilities and has two fixes
is now available.
Description:
This update for cups fixes the following issues:
The following security vulnerabilities were fixed:
- CVE-2017-18248: Handle invalid characters properly in printing jobs.
This fixes a problem that was causing the DBUS library to abort the
calling process. (bsc#1061066 bsc#1087018)
- Fixed a local privilege escalation to root and sandbox bypasses in the
scheduler
- CVE-2018-4180: Fixed a local privilege escalation to root in dnssd
backend (bsc#1096405)
- CVE-2018-4181: Limited local file reads as root via cupsd.conf include
directive (bsc#1096406)
- CVE-2018-4182: Fixed a sandbox bypass due to insecure error handling
(bsc#1096407)
- CVE-2018-4183: Fixed a sandbox bypass due to profile misconfiguration
(bsc#1096408)
The following other issue was fixed:
- Fixed authorization check for clients (like samba) connected through the
local socket when Kerberos authentication is enabled (bsc#1050082)
This update was imported from the SUSE:SLE-12:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2018-822=1
Package List:
- openSUSE Leap 42.3 (i586 x86_64):
cups-1.7.5-12.6.1
cups-client-1.7.5-12.6.1
cups-client-debuginfo-1.7.5-12.6.1
cups-ddk-1.7.5-12.6.1
cups-ddk-debuginfo-1.7.5-12.6.1
cups-debuginfo-1.7.5-12.6.1
cups-debugsource-1.7.5-12.6.1
cups-devel-1.7.5-12.6.1
cups-libs-1.7.5-12.6.1
cups-libs-debuginfo-1.7.5-12.6.1
- openSUSE Leap 42.3 (x86_64):
cups-libs-32bit-1.7.5-12.6.1
cups-libs-debuginfo-32bit-1.7.5-12.6.1
References:
https://www.suse.com/security/cve/CVE-2017-18248.html
https://www.suse.com/security/cve/CVE-2018-4180.html
https://www.suse.com/security/cve/CVE-2018-4181.html
https://www.suse.com/security/cve/CVE-2018-4182.html
https://www.suse.com/security/cve/CVE-2018-4183.html
https://bugzilla.suse.com/1050082
https://bugzilla.suse.com/1061066
https://bugzilla.suse.com/1087018
https://bugzilla.suse.com/1096405
https://bugzilla.suse.com/1096406
https://bugzilla.suse.com/1096407
https://bugzilla.suse.com/1096408
--
openSUSE-SU-2018:2241-1: moderate: Security update for libcgroup
openSUSE Security Update: Security update for libcgroup
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:2241-1
Rating: moderate
References: #1100365
Cross-References: CVE-2018-14348
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for libcgroup fixes the following issues:
The following security vulnerability was fixed:
- CVE-2018-14348: Fixed a permission issue with /var/log/cgred. The
permissions were not restrictive enough beforehand and ignored any umask
setting. (boo#1100365)
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2018-821=1
Package List:
- openSUSE Leap 42.3 (i586 x86_64):
libcgroup-debugsource-0.41-8.3.1
libcgroup-devel-0.41-8.3.1
libcgroup-tools-0.41-8.3.1
libcgroup-tools-debuginfo-0.41-8.3.1
libcgroup1-0.41-8.3.1
libcgroup1-debuginfo-0.41-8.3.1
- openSUSE Leap 42.3 (x86_64):
libcgroup1-32bit-0.41-8.3.1
libcgroup1-debuginfo-32bit-0.41-8.3.1
References:
https://www.suse.com/security/cve/CVE-2018-14348.html
https://bugzilla.suse.com/1100365
--
openSUSE-SU-2018:2242-1: important: Security update for the Linux Kernel
openSUSE Security Update: Security update for the Linux Kernel
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:2242-1
Rating: important
References: #1012382 #1037697 #1046299 #1046300 #1046302
#1046303 #1046305 #1046306 #1046307 #1046533
#1046543 #1050242 #1050536 #1050538 #1050540
#1051510 #1054245 #1056651 #1056787 #1058169
#1058659 #1060463 #1066110 #1068032 #1075087
#1075360 #1077338 #1077761 #1077989 #1085042
#1085536 #1085539 #1086301 #1086313 #1086314
#1086324 #1086457 #1087092 #1087202 #1087217
#1087233 #1090098 #1090888 #1091041 #1091171
#1093148 #1093666 #1094119 #1096330 #1097583
#1097584 #1097585 #1097586 #1097587 #1097588
#1098633 #1099193 #1100132 #1100884 #1101143
#1101337 #1101352 #1101465 #1101564 #1101669
#1101674 #1101789 #1101813 #1101816 #1102088
#1102097 #1102147 #1102340 #1102512 #1102851
#1103216 #1103220 #1103230 #1103356 #1103421
#1103517 #1103723 #1103724 #1103725 #1103726
#1103727 #1103728 #1103729 #1103730
Cross-References: CVE-2017-18344 CVE-2018-5390
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________
An update that solves two vulnerabilities and has 87 fixes
is now available.
Description:
The openSUSE Leap 15.0 kernel was updated to receive various security and
bugfixes.
The following security bugs were fixed:
- CVE-2018-5390 aka "SegmentSmack": A remote attacker even with relatively
low bandwidth could have caused lots of CPU usage by triggering the
worst case scenario during IP and/or TCP fragment reassembly
(bsc#1102340)
- CVE-2017-18344: The timer_create syscall implementation in
kernel/time/posix-timers.c in the Linux kernel doesn't properly validate
the sigevent->sigev_notify field, which leads to out-of-bounds access in
the show_timer function (called when /proc/$PID/timers is read). This
allowed userspace applications to read arbitrary kernel memory (on a
kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE)
(bnc#1102851).
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2018-826=1
Package List:
- openSUSE Leap 15.0 (noarch):
kernel-devel-4.12.14-lp150.12.10.1
kernel-docs-4.12.14-lp150.12.10.1
kernel-docs-html-4.12.14-lp150.12.10.1
kernel-macros-4.12.14-lp150.12.10.1
kernel-source-4.12.14-lp150.12.10.1
kernel-source-vanilla-4.12.14-lp150.12.10.1
- openSUSE Leap 15.0 (x86_64):
kernel-debug-4.12.14-lp150.12.10.1
kernel-debug-base-4.12.14-lp150.12.10.1
kernel-debug-base-debuginfo-4.12.14-lp150.12.10.1
kernel-debug-debuginfo-4.12.14-lp150.12.10.1
kernel-debug-debugsource-4.12.14-lp150.12.10.1
kernel-debug-devel-4.12.14-lp150.12.10.1
kernel-debug-devel-debuginfo-4.12.14-lp150.12.10.1
kernel-default-4.12.14-lp150.12.10.1
kernel-default-base-4.12.14-lp150.12.10.1
kernel-default-base-debuginfo-4.12.14-lp150.12.10.1
kernel-default-debuginfo-4.12.14-lp150.12.10.1
kernel-default-debugsource-4.12.14-lp150.12.10.1
kernel-default-devel-4.12.14-lp150.12.10.1
kernel-default-devel-debuginfo-4.12.14-lp150.12.10.1
kernel-kvmsmall-4.12.14-lp150.12.10.1
kernel-kvmsmall-base-4.12.14-lp150.12.10.1
kernel-kvmsmall-base-debuginfo-4.12.14-lp150.12.10.1
kernel-kvmsmall-debuginfo-4.12.14-lp150.12.10.1
kernel-kvmsmall-debugsource-4.12.14-lp150.12.10.1
kernel-kvmsmall-devel-4.12.14-lp150.12.10.1
kernel-kvmsmall-devel-debuginfo-4.12.14-lp150.12.10.1
kernel-obs-build-4.12.14-lp150.12.10.1
kernel-obs-build-debugsource-4.12.14-lp150.12.10.1
kernel-obs-qa-4.12.14-lp150.12.10.1
kernel-syms-4.12.14-lp150.12.10.1
kernel-vanilla-4.12.14-lp150.12.10.1
kernel-vanilla-base-4.12.14-lp150.12.10.1
kernel-vanilla-base-debuginfo-4.12.14-lp150.12.10.1
kernel-vanilla-debuginfo-4.12.14-lp150.12.10.1
kernel-vanilla-debugsource-4.12.14-lp150.12.10.1
kernel-vanilla-devel-4.12.14-lp150.12.10.1
kernel-vanilla-devel-debuginfo-4.12.14-lp150.12.10.1
References:
https://www.suse.com/security/cve/CVE-2017-18344.html
https://www.suse.com/security/cve/CVE-2018-5390.html
https://bugzilla.suse.com/1012382
https://bugzilla.suse.com/1037697
https://bugzilla.suse.com/1046299
https://bugzilla.suse.com/1046300
https://bugzilla.suse.com/1046302
https://bugzilla.suse.com/1046303
https://bugzilla.suse.com/1046305
https://bugzilla.suse.com/1046306
https://bugzilla.suse.com/1046307
https://bugzilla.suse.com/1046533
https://bugzilla.suse.com/1046543
https://bugzilla.suse.com/1050242
https://bugzilla.suse.com/1050536
https://bugzilla.suse.com/1050538
https://bugzilla.suse.com/1050540
https://bugzilla.suse.com/1051510
https://bugzilla.suse.com/1054245
https://bugzilla.suse.com/1056651
https://bugzilla.suse.com/1056787
https://bugzilla.suse.com/1058169
https://bugzilla.suse.com/1058659
https://bugzilla.suse.com/1060463
https://bugzilla.suse.com/1066110
https://bugzilla.suse.com/1068032
https://bugzilla.suse.com/1075087
https://bugzilla.suse.com/1075360
https://bugzilla.suse.com/1077338
https://bugzilla.suse.com/1077761
https://bugzilla.suse.com/1077989
https://bugzilla.suse.com/1085042
https://bugzilla.suse.com/1085536
https://bugzilla.suse.com/1085539
https://bugzilla.suse.com/1086301
https://bugzilla.suse.com/1086313
https://bugzilla.suse.com/1086314
https://bugzilla.suse.com/1086324
https://bugzilla.suse.com/1086457
https://bugzilla.suse.com/1087092
https://bugzilla.suse.com/1087202
https://bugzilla.suse.com/1087217
https://bugzilla.suse.com/1087233
https://bugzilla.suse.com/1090098
https://bugzilla.suse.com/1090888
https://bugzilla.suse.com/1091041
https://bugzilla.suse.com/1091171
https://bugzilla.suse.com/1093148
https://bugzilla.suse.com/1093666
https://bugzilla.suse.com/1094119
https://bugzilla.suse.com/1096330
https://bugzilla.suse.com/1097583
https://bugzilla.suse.com/1097584
https://bugzilla.suse.com/1097585
https://bugzilla.suse.com/1097586
https://bugzilla.suse.com/1097587
https://bugzilla.suse.com/1097588
https://bugzilla.suse.com/1098633
https://bugzilla.suse.com/1099193
https://bugzilla.suse.com/1100132
https://bugzilla.suse.com/1100884
https://bugzilla.suse.com/1101143
https://bugzilla.suse.com/1101337
https://bugzilla.suse.com/1101352
https://bugzilla.suse.com/1101465
https://bugzilla.suse.com/1101564
https://bugzilla.suse.com/1101669
https://bugzilla.suse.com/1101674
https://bugzilla.suse.com/1101789
https://bugzilla.suse.com/1101813
https://bugzilla.suse.com/1101816
https://bugzilla.suse.com/1102088
https://bugzilla.suse.com/1102097
https://bugzilla.suse.com/1102147
https://bugzilla.suse.com/1102340
https://bugzilla.suse.com/1102512
https://bugzilla.suse.com/1102851
https://bugzilla.suse.com/1103216
https://bugzilla.suse.com/1103220
https://bugzilla.suse.com/1103230
https://bugzilla.suse.com/1103356
https://bugzilla.suse.com/1103421
https://bugzilla.suse.com/1103517
https://bugzilla.suse.com/1103723
https://bugzilla.suse.com/1103724
https://bugzilla.suse.com/1103725
https://bugzilla.suse.com/1103726
https://bugzilla.suse.com/1103727
https://bugzilla.suse.com/1103728
https://bugzilla.suse.com/1103729
https://bugzilla.suse.com/1103730
--
