The following updates has been released for SUSE:

openSUSE-SU-2018:2723-1: Security update for ffmpeg-4
openSUSE-SU-2018:2724-1: moderate: Security update for chromium
openSUSE-SU-2018:2727-1: moderate: Security update for okular
openSUSE-SU-2018:2728-1: moderate: Security update for chromium
openSUSE-SU-2018:2730-1: important: Security update for spice-gtk
openSUSE-SU-2018:2731-1: moderate: Security update for curl
openSUSE-SU-2018:2733-1: moderate: Security update for okular
openSUSE-SU-2018:2734-1: Security update for ffmpeg-4
openSUSE-SU-2018:2736-1: moderate: Security update for curl

openSUSE-SU-2018:2723-1: Security update for ffmpeg-4

openSUSE Security Update: Security update for ffmpeg-4
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:2723-1
Rating: low
References: #1092241 #1100348 #1105869
Cross-References: CVE-2018-13300 CVE-2018-15822
Affected Products:
openSUSE Leap 42.3
openSUSE Leap 15.0
______________________________________________________________________________

An update that solves two vulnerabilities and has one
errata is now available.

Description:

This update for ffmpeg-4 to version 4.0.2 fixes the following issues:

These security issues were fixed:

- CVE-2018-15822: The flv_write_packet function did not check for an empty
audio packet, leading to an assertion failure and DoS (bsc#1105869).
- CVE-2018-13300: An improper argument passed to the avpriv_request_sample
function may have triggered an out-of-array read while converting a
crafted AVI file to MPEG4, leading to a denial of service and possibly
an information disclosure (bsc#1100348).

These non-security issues were fixed:

- Enable webvtt encoders and decoders (boo#1092241).
- Build codec2 encoder and decoder, add libcodec2 to enable_decoders and
enable_encoders.
- Enable mpeg 1 and 2 encoders.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-1004=1

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-1004=1



Package List:

- openSUSE Leap 42.3 (i586 x86_64):

ffmpeg-4-debugsource-4.0.2-13.1
ffmpeg-4-libavcodec-devel-4.0.2-13.1
ffmpeg-4-libavdevice-devel-4.0.2-13.1
ffmpeg-4-libavfilter-devel-4.0.2-13.1
ffmpeg-4-libavformat-devel-4.0.2-13.1
ffmpeg-4-libavresample-devel-4.0.2-13.1
ffmpeg-4-libavutil-devel-4.0.2-13.1
ffmpeg-4-libpostproc-devel-4.0.2-13.1
ffmpeg-4-libswresample-devel-4.0.2-13.1
ffmpeg-4-libswscale-devel-4.0.2-13.1
ffmpeg-4-private-devel-4.0.2-13.1
libavcodec58-4.0.2-13.1
libavcodec58-debuginfo-4.0.2-13.1
libavdevice58-4.0.2-13.1
libavdevice58-debuginfo-4.0.2-13.1
libavfilter7-4.0.2-13.1
libavfilter7-debuginfo-4.0.2-13.1
libavformat58-4.0.2-13.1
libavformat58-debuginfo-4.0.2-13.1
libavresample4-4.0.2-13.1
libavresample4-debuginfo-4.0.2-13.1
libavutil56-4.0.2-13.1
libavutil56-debuginfo-4.0.2-13.1
libpostproc55-4.0.2-13.1
libpostproc55-debuginfo-4.0.2-13.1
libswresample3-4.0.2-13.1
libswresample3-debuginfo-4.0.2-13.1
libswscale5-4.0.2-13.1
libswscale5-debuginfo-4.0.2-13.1

- openSUSE Leap 42.3 (x86_64):

libavcodec58-32bit-4.0.2-13.1
libavcodec58-debuginfo-32bit-4.0.2-13.1
libavdevice58-32bit-4.0.2-13.1
libavdevice58-debuginfo-32bit-4.0.2-13.1
libavfilter7-32bit-4.0.2-13.1
libavfilter7-debuginfo-32bit-4.0.2-13.1
libavformat58-32bit-4.0.2-13.1
libavformat58-debuginfo-32bit-4.0.2-13.1
libavresample4-32bit-4.0.2-13.1
libavresample4-debuginfo-32bit-4.0.2-13.1
libavutil56-32bit-4.0.2-13.1
libavutil56-debuginfo-32bit-4.0.2-13.1
libpostproc55-32bit-4.0.2-13.1
libpostproc55-debuginfo-32bit-4.0.2-13.1
libswresample3-32bit-4.0.2-13.1
libswresample3-debuginfo-32bit-4.0.2-13.1
libswscale5-32bit-4.0.2-13.1
libswscale5-debuginfo-32bit-4.0.2-13.1

- openSUSE Leap 15.0 (x86_64):

ffmpeg-4-debugsource-4.0.2-lp150.13.1
ffmpeg-4-libavcodec-devel-4.0.2-lp150.13.1
ffmpeg-4-libavdevice-devel-4.0.2-lp150.13.1
ffmpeg-4-libavfilter-devel-4.0.2-lp150.13.1
ffmpeg-4-libavformat-devel-4.0.2-lp150.13.1
ffmpeg-4-libavresample-devel-4.0.2-lp150.13.1
ffmpeg-4-libavutil-devel-4.0.2-lp150.13.1
ffmpeg-4-libpostproc-devel-4.0.2-lp150.13.1
ffmpeg-4-libswresample-devel-4.0.2-lp150.13.1
ffmpeg-4-libswscale-devel-4.0.2-lp150.13.1
ffmpeg-4-private-devel-4.0.2-lp150.13.1
libavcodec58-4.0.2-lp150.13.1
libavcodec58-debuginfo-4.0.2-lp150.13.1
libavdevice58-4.0.2-lp150.13.1
libavdevice58-debuginfo-4.0.2-lp150.13.1
libavfilter7-4.0.2-lp150.13.1
libavfilter7-debuginfo-4.0.2-lp150.13.1
libavformat58-4.0.2-lp150.13.1
libavformat58-debuginfo-4.0.2-lp150.13.1
libavresample4-4.0.2-lp150.13.1
libavresample4-debuginfo-4.0.2-lp150.13.1
libavutil56-4.0.2-lp150.13.1
libavutil56-debuginfo-4.0.2-lp150.13.1
libpostproc55-4.0.2-lp150.13.1
libpostproc55-debuginfo-4.0.2-lp150.13.1
libswresample3-4.0.2-lp150.13.1
libswresample3-debuginfo-4.0.2-lp150.13.1
libswscale5-4.0.2-lp150.13.1
libswscale5-debuginfo-4.0.2-lp150.13.1


References:

https://www.suse.com/security/cve/CVE-2018-13300.html
https://www.suse.com/security/cve/CVE-2018-15822.html
https://bugzilla.suse.com/1092241
https://bugzilla.suse.com/1100348
https://bugzilla.suse.com/1105869

--

openSUSE-SU-2018:2724-1: moderate: Security update for chromium

openSUSE Security Update: Security update for chromium
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:2724-1
Rating: moderate
References: #1108114 #1108175
Affected Products:
SUSE Package Hub for SUSE Linux Enterprise 12
______________________________________________________________________________

An update that contains security fixes can now be installed.

Description:

This update for Chromium to version 69.0.3497.92 fixes the following
issues:

Security issues fixed ((boo#1108114):

- Function signature mismatch in WebAssembly
- URL Spoofing in Omnibox

The following tracked packaging issues were fixed:

- the chromium package incorrectly provied swiftshader resolvables
(boo#1108175)


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- SUSE Package Hub for SUSE Linux Enterprise 12:

zypper in -t patch openSUSE-2018-1005=1



Package List:

- SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64):

chromedriver-69.0.3497.92-68.1
chromedriver-debuginfo-69.0.3497.92-68.1
chromium-69.0.3497.92-68.1
chromium-debuginfo-69.0.3497.92-68.1
chromium-debugsource-69.0.3497.92-68.1


References:

https://bugzilla.suse.com/1108114
https://bugzilla.suse.com/1108175

--

openSUSE-SU-2018:2727-1: moderate: Security update for okular

openSUSE Security Update: Security update for okular
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:2727-1
Rating: moderate
References: #1107591
Cross-References: CVE-2018-1000801
Affected Products:
SUSE Package Hub for SUSE Linux Enterprise 12
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for okular fixes the following security issue:

- CVE-2018-1000801: Prevent directory traversal vulnerability in function
unpackDocumentArchive could have resulted in arbitrary file creation via
a specially crafted Okular archive (bsc#1107591).


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- SUSE Package Hub for SUSE Linux Enterprise 12:

zypper in -t patch openSUSE-2018-1006=1



Package List:

- SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64):

okular-17.04.2-11.1
okular-debuginfo-17.04.2-11.1
okular-debugsource-17.04.2-11.1
okular-devel-17.04.2-11.1

- SUSE Package Hub for SUSE Linux Enterprise 12 (noarch):

okular-lang-17.04.2-11.1


References:

https://www.suse.com/security/cve/CVE-2018-1000801.html
https://bugzilla.suse.com/1107591

--

openSUSE-SU-2018:2728-1: moderate: Security update for chromium

openSUSE Security Update: Security update for chromium
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:2728-1
Rating: moderate
References: #1108114 #1108175
Affected Products:
openSUSE Leap 42.3
openSUSE Leap 15.0
______________________________________________________________________________

An update that contains security fixes can now be installed.

Description:

This update for Chromium to version 69.0.3497.92 fixes the following
issues:

Security issues fixed ((boo#1108114):

- Function signature mismatch in WebAssembly
- URL Spoofing in Omnibox

The following tracked packaging issues were fixed:

- the chromium package incorrectly provied swiftshader resolvables
(boo#1108175)


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-1005=1

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-1005=1



Package List:

- openSUSE Leap 42.3 (x86_64):

chromedriver-69.0.3497.92-171.1
chromedriver-debuginfo-69.0.3497.92-171.1
chromium-69.0.3497.92-171.1
chromium-debuginfo-69.0.3497.92-171.1
chromium-debugsource-69.0.3497.92-171.1

- openSUSE Leap 15.0 (x86_64):

chromedriver-69.0.3497.92-lp150.2.13.1
chromedriver-debuginfo-69.0.3497.92-lp150.2.13.1
chromium-69.0.3497.92-lp150.2.13.1
chromium-debuginfo-69.0.3497.92-lp150.2.13.1
chromium-debugsource-69.0.3497.92-lp150.2.13.1


References:

https://bugzilla.suse.com/1108114
https://bugzilla.suse.com/1108175

--

openSUSE-SU-2018:2730-1: important: Security update for spice-gtk

openSUSE Security Update: Security update for spice-gtk
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:2730-1
Rating: important
References: #1101295 #1101420 #1104448
Cross-References: CVE-2018-10873 CVE-2018-10893
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that solves two vulnerabilities and has one
errata is now available.

Description:

This update for spice-gtk fixes the following issues:

Security issues fixed:

- CVE-2018-10873: Fix potential heap corruption when demarshalling
(bsc#1104448)
- CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295)

Other bugs fixed:

- Add setuid bit to spice-client-glib-usb-acl-helper (bsc#1101420)

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-1015=1



Package List:

- openSUSE Leap 15.0 (x86_64):

libspice-client-glib-2_0-8-0.34-lp150.2.3.1
libspice-client-glib-2_0-8-debuginfo-0.34-lp150.2.3.1
libspice-client-glib-helper-0.34-lp150.2.3.1
libspice-client-glib-helper-debuginfo-0.34-lp150.2.3.1
libspice-client-gtk-3_0-5-0.34-lp150.2.3.1
libspice-client-gtk-3_0-5-debuginfo-0.34-lp150.2.3.1
libspice-controller0-0.34-lp150.2.3.1
libspice-controller0-debuginfo-0.34-lp150.2.3.1
spice-gtk-0.34-lp150.2.3.1
spice-gtk-debuginfo-0.34-lp150.2.3.1
spice-gtk-debugsource-0.34-lp150.2.3.1
spice-gtk-devel-0.34-lp150.2.3.1
typelib-1_0-SpiceClientGlib-2_0-0.34-lp150.2.3.1
typelib-1_0-SpiceClientGtk-3_0-0.34-lp150.2.3.1

- openSUSE Leap 15.0 (noarch):

spice-gtk-lang-0.34-lp150.2.3.1


References:

https://www.suse.com/security/cve/CVE-2018-10873.html
https://www.suse.com/security/cve/CVE-2018-10893.html
https://bugzilla.suse.com/1101295
https://bugzilla.suse.com/1101420
https://bugzilla.suse.com/1104448

--

openSUSE-SU-2018:2731-1: moderate: Security update for curl

openSUSE Security Update: Security update for curl
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:2731-1
Rating: moderate
References: #1086367 #1106019
Cross-References: CVE-2018-14618
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that solves one vulnerability and has one errata
is now available.

Description:

This update for curl fixes the following issues:

This security issue was fixed:

- CVE-2018-14618: Prevent integer overflow in the NTLM authentication code
(bsc#1106019)

This non-security issue was fixed:

- Use OPENSSL_config instead of CONF_modules_load_file() to avoid crashes
due to openssl engines conflicts (bsc#1086367)

This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-1010=1



Package List:

- openSUSE Leap 15.0 (i586 x86_64):

curl-7.60.0-lp150.2.12.1
curl-debuginfo-7.60.0-lp150.2.12.1
curl-debugsource-7.60.0-lp150.2.12.1
curl-mini-7.60.0-lp150.2.12.1
curl-mini-debuginfo-7.60.0-lp150.2.12.1
curl-mini-debugsource-7.60.0-lp150.2.12.1
libcurl-devel-7.60.0-lp150.2.12.1
libcurl-mini-devel-7.60.0-lp150.2.12.1
libcurl4-7.60.0-lp150.2.12.1
libcurl4-debuginfo-7.60.0-lp150.2.12.1
libcurl4-mini-7.60.0-lp150.2.12.1
libcurl4-mini-debuginfo-7.60.0-lp150.2.12.1

- openSUSE Leap 15.0 (x86_64):

libcurl-devel-32bit-7.60.0-lp150.2.12.1
libcurl4-32bit-7.60.0-lp150.2.12.1
libcurl4-32bit-debuginfo-7.60.0-lp150.2.12.1


References:

https://www.suse.com/security/cve/CVE-2018-14618.html
https://bugzilla.suse.com/1086367
https://bugzilla.suse.com/1106019

--

openSUSE-SU-2018:2733-1: moderate: Security update for okular

openSUSE Security Update: Security update for okular
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:2733-1
Rating: moderate
References: #1107591
Cross-References: CVE-2018-1000801
Affected Products:
openSUSE Leap 42.3
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for okular fixes the following security issue:

- CVE-2018-1000801: Prevent directory traversal vulnerability in function
unpackDocumentArchive could have resulted in arbitrary file creation via
a specially crafted Okular archive (bsc#1107591).


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-1006=1

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-1006=1



Package List:

- openSUSE Leap 42.3 (x86_64):

okular-17.04.2-6.1
okular-debuginfo-17.04.2-6.1
okular-debugsource-17.04.2-6.1
okular-devel-17.04.2-6.1

- openSUSE Leap 42.3 (noarch):

okular-lang-17.04.2-6.1

- openSUSE Leap 15.0 (x86_64):

okular-17.12.3-lp150.3.3.1
okular-debuginfo-17.12.3-lp150.3.3.1
okular-debugsource-17.12.3-lp150.3.3.1
okular-devel-17.12.3-lp150.3.3.1

- openSUSE Leap 15.0 (noarch):

okular-lang-17.12.3-lp150.3.3.1


References:

https://www.suse.com/security/cve/CVE-2018-1000801.html
https://bugzilla.suse.com/1107591

--

openSUSE-SU-2018:2734-1: Security update for ffmpeg-4

openSUSE Security Update: Security update for ffmpeg-4
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:2734-1
Rating: low
References: #1092241 #1100348 #1105869
Cross-References: CVE-2018-13300 CVE-2018-15822
Affected Products:
SUSE Package Hub for SUSE Linux Enterprise 12
______________________________________________________________________________

An update that solves two vulnerabilities and has one
errata is now available.

Description:

This update for ffmpeg-4 to version 4.0.2 fixes the following issues:

These security issues were fixed:

- CVE-2018-15822: The flv_write_packet function did not check for an empty
audio packet, leading to an assertion failure and DoS (bsc#1105869).
- CVE-2018-13300: An improper argument passed to the avpriv_request_sample
function may have triggered an out-of-array read while converting a
crafted AVI file to MPEG4, leading to a denial of service and possibly
an information disclosure (bsc#1100348).

These non-security issues were fixed:

- Enable webvtt encoders and decoders (boo#1092241).
- Build codec2 encoder and decoder, add libcodec2 to enable_decoders and
enable_encoders.
- Enable mpeg 1 and 2 encoders.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- SUSE Package Hub for SUSE Linux Enterprise 12:

zypper in -t patch openSUSE-2018-1004=1



Package List:

- SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64):

ffmpeg-4-libavcodec-devel-4.0.2-13.1
ffmpeg-4-libavdevice-devel-4.0.2-13.1
ffmpeg-4-libavfilter-devel-4.0.2-13.1
ffmpeg-4-libavformat-devel-4.0.2-13.1
ffmpeg-4-libavresample-devel-4.0.2-13.1
ffmpeg-4-libavutil-devel-4.0.2-13.1
ffmpeg-4-libpostproc-devel-4.0.2-13.1
ffmpeg-4-libswresample-devel-4.0.2-13.1
ffmpeg-4-libswscale-devel-4.0.2-13.1
ffmpeg-4-private-devel-4.0.2-13.1
libavcodec58-4.0.2-13.1
libavdevice58-4.0.2-13.1
libavfilter7-4.0.2-13.1
libavformat58-4.0.2-13.1
libavresample4-4.0.2-13.1
libavutil56-4.0.2-13.1
libpostproc55-4.0.2-13.1
libswresample3-4.0.2-13.1
libswscale5-4.0.2-13.1


References:

https://www.suse.com/security/cve/CVE-2018-13300.html
https://www.suse.com/security/cve/CVE-2018-15822.html
https://bugzilla.suse.com/1092241
https://bugzilla.suse.com/1100348
https://bugzilla.suse.com/1105869

--

openSUSE-SU-2018:2736-1: moderate: Security update for curl

openSUSE Security Update: Security update for curl
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:2736-1
Rating: moderate
References: #1089533 #1106019
Cross-References: CVE-2018-14618
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that solves one vulnerability and has one errata
is now available.

Description:

This update for curl fixes the following issues:

This security issue was fixed:

- CVE-2018-14618: Prevent integer overflow in the NTLM authentication code
(bsc#1106019)

This non-security issue was fixed:

- Fixed erroneous debug message when paired with OpenSSL (bsc#1089533)

This update was imported from the SUSE:SLE-12:Update update project.


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-1008=1



Package List:

- openSUSE Leap 42.3 (i586 x86_64):

curl-7.37.0-39.1
curl-debuginfo-7.37.0-39.1
curl-debugsource-7.37.0-39.1
libcurl-devel-7.37.0-39.1
libcurl4-7.37.0-39.1
libcurl4-debuginfo-7.37.0-39.1

- openSUSE Leap 42.3 (x86_64):

libcurl-devel-32bit-7.37.0-39.1
libcurl4-32bit-7.37.0-39.1
libcurl4-debuginfo-32bit-7.37.0-39.1


References:

https://www.suse.com/security/cve/CVE-2018-14618.html
https://bugzilla.suse.com/1089533
https://bugzilla.suse.com/1106019

--