The following updates has been released for openSUSE:
openSUSE-SU-2018:4050-1: moderate: Security update for openssl-1_0_0
openSUSE-SU-2018:4051-1: important: Security update for libgit2
openSUSE-SU-2018:4053-1: moderate: Security update for tiff
openSUSE-SU-2018:4054-1: moderate: Security update for ImageMagick
openSUSE-SU-2018:4055-1: important: Security update for ncurses
openSUSE-SU-2018:4056-1: important: Security update for Chromium
openSUSE-SU-2018:4050-1: moderate: Security update for openssl-1_0_0
openSUSE-SU-2018:4051-1: important: Security update for libgit2
openSUSE-SU-2018:4053-1: moderate: Security update for tiff
openSUSE-SU-2018:4054-1: moderate: Security update for ImageMagick
openSUSE-SU-2018:4055-1: important: Security update for ncurses
openSUSE-SU-2018:4056-1: important: Security update for Chromium
openSUSE-SU-2018:4050-1: moderate: Security update for openssl-1_0_0
openSUSE Security Update: Security update for openssl-1_0_0
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:4050-1
Rating: moderate
References: #1100078 #1112209 #1113534 #1113652 #1113742
Cross-References: CVE-2018-0734 CVE-2018-5407
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________
An update that solves two vulnerabilities and has three
fixes is now available.
Description:
This update for openssl-1_0_0 fixes the following issues:
Security issues fixed:
- CVE-2018-0734: Fixed timing vulnerability in DSA signature generation
(bsc#1113652).
- CVE-2018-5407: Added elliptic curve scalar multiplication timing attack
defenses that fixes "PortSmash" (bsc#1113534).
Non-security issues fixed:
- Added missing timing side channel patch for DSA signature generation
(bsc#1113742).
- Set TLS version to 0 in msg_callback for record messages to avoid
confusing applications (bsc#1100078).
- Fixed infinite loop in DSA generation with incorrect parameters
(bsc#1112209)
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2018-1518=1
Package List:
- openSUSE Leap 15.0 (i586 x86_64):
libopenssl-1_0_0-devel-1.0.2p-lp150.2.9.1
libopenssl1_0_0-1.0.2p-lp150.2.9.1
libopenssl1_0_0-debuginfo-1.0.2p-lp150.2.9.1
libopenssl1_0_0-hmac-1.0.2p-lp150.2.9.1
libopenssl1_0_0-steam-1.0.2p-lp150.2.9.1
libopenssl1_0_0-steam-debuginfo-1.0.2p-lp150.2.9.1
openssl-1_0_0-1.0.2p-lp150.2.9.1
openssl-1_0_0-cavs-1.0.2p-lp150.2.9.1
openssl-1_0_0-cavs-debuginfo-1.0.2p-lp150.2.9.1
openssl-1_0_0-debuginfo-1.0.2p-lp150.2.9.1
openssl-1_0_0-debugsource-1.0.2p-lp150.2.9.1
- openSUSE Leap 15.0 (noarch):
openssl-1_0_0-doc-1.0.2p-lp150.2.9.1
- openSUSE Leap 15.0 (x86_64):
libopenssl-1_0_0-devel-32bit-1.0.2p-lp150.2.9.1
libopenssl1_0_0-32bit-1.0.2p-lp150.2.9.1
libopenssl1_0_0-32bit-debuginfo-1.0.2p-lp150.2.9.1
libopenssl1_0_0-hmac-32bit-1.0.2p-lp150.2.9.1
libopenssl1_0_0-steam-32bit-1.0.2p-lp150.2.9.1
libopenssl1_0_0-steam-32bit-debuginfo-1.0.2p-lp150.2.9.1
References:
https://www.suse.com/security/cve/CVE-2018-0734.html
https://www.suse.com/security/cve/CVE-2018-5407.html
https://bugzilla.suse.com/1100078
https://bugzilla.suse.com/1112209
https://bugzilla.suse.com/1113534
https://bugzilla.suse.com/1113652
https://bugzilla.suse.com/1113742
--
openSUSE-SU-2018:4051-1: important: Security update for libgit2
openSUSE Security Update: Security update for libgit2
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:4051-1
Rating: important
References: #1110949 #1114729
Cross-References: CVE-2018-17456
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________
An update that solves one vulnerability and has one errata
is now available.
Description:
This update for libgit2 fixes the following issues:
Security issue fixed:
- CVE-2018-17456: Submodule URLs and paths with a leading "-" are now
ignored to avoid injecting options into library consumers that perform
recursive clones (bsc#1110949).
Non-security issues fixed:
- Version update to version 0.26.8 (bsc#1114729).
- Full changelog can be found at:
* https://github.com/libgit2/libgit2/releases/tag/v0.26.8
* https://github.com/libgit2/libgit2/releases/tag/v0.26.7
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2018-1517=1
Package List:
- openSUSE Leap 15.0 (i586 x86_64):
libgit2-26-0.26.8-lp150.2.6.1
libgit2-26-debuginfo-0.26.8-lp150.2.6.1
libgit2-debugsource-0.26.8-lp150.2.6.1
libgit2-devel-0.26.8-lp150.2.6.1
- openSUSE Leap 15.0 (x86_64):
libgit2-26-32bit-0.26.8-lp150.2.6.1
libgit2-26-32bit-debuginfo-0.26.8-lp150.2.6.1
References:
https://www.suse.com/security/cve/CVE-2018-17456.html
https://bugzilla.suse.com/1110949
https://bugzilla.suse.com/1114729
--
openSUSE-SU-2018:4053-1: moderate: Security update for tiff
openSUSE Security Update: Security update for tiff
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:4053-1
Rating: moderate
References: #1017693 #1054594 #1115717 #990460
Cross-References: CVE-2016-10092 CVE-2016-10093 CVE-2016-10094
CVE-2016-6223 CVE-2017-12944 CVE-2018-19210
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________
An update that fixes 6 vulnerabilities is now available.
Description:
This update for tiff fixes the following issues:
Security issues fixed:
- CVE-2018-19210: Fixed NULL pointer dereference in the
TIFFWriteDirectorySec function (bsc#1115717).
- CVE-2017-12944: Fixed denial of service issue in the
TIFFReadDirEntryArray function (bsc#1054594).
- CVE-2016-10094: Fixed heap-based buffer overflow in the _tiffWriteProc
function (bsc#1017693).
- CVE-2016-10093: Fixed heap-based buffer overflow in the _TIFFmemcpy
function (bsc#1017693).
- CVE-2016-10092: Fixed heap-based buffer overflow in the TIFFReverseBits
function (bsc#1017693).
- CVE-2016-6223: Fixed out-of-bounds read on memory-mapped files in
TIFFReadRawStrip1() and TIFFReadRawTile1() (bsc#990460).
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2018-1522=1
Package List:
- openSUSE Leap 15.0 (i586 x86_64):
libtiff-devel-4.0.9-lp150.4.12.1
libtiff5-4.0.9-lp150.4.12.1
libtiff5-debuginfo-4.0.9-lp150.4.12.1
tiff-4.0.9-lp150.4.12.1
tiff-debuginfo-4.0.9-lp150.4.12.1
tiff-debugsource-4.0.9-lp150.4.12.1
- openSUSE Leap 15.0 (x86_64):
libtiff-devel-32bit-4.0.9-lp150.4.12.1
libtiff5-32bit-4.0.9-lp150.4.12.1
libtiff5-32bit-debuginfo-4.0.9-lp150.4.12.1
References:
https://www.suse.com/security/cve/CVE-2016-10092.html
https://www.suse.com/security/cve/CVE-2016-10093.html
https://www.suse.com/security/cve/CVE-2016-10094.html
https://www.suse.com/security/cve/CVE-2016-6223.html
https://www.suse.com/security/cve/CVE-2017-12944.html
https://www.suse.com/security/cve/CVE-2018-19210.html
https://bugzilla.suse.com/1017693
https://bugzilla.suse.com/1054594
https://bugzilla.suse.com/1115717
https://bugzilla.suse.com/990460
--
openSUSE-SU-2018:4054-1: moderate: Security update for ImageMagick
openSUSE Security Update: Security update for ImageMagick
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:4054-1
Rating: moderate
References: #1057246 #1113064 #1117463
Cross-References: CVE-2018-18544
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________
An update that solves one vulnerability and has two fixes
is now available.
Description:
This update for ImageMagick fixes the following issues:
Security issues fixed:
- CVE-2018-18544: Fixed memory leak in the function WriteMSLImage
(bsc#1113064).
Non-security issues fixed:
- Improve import documentation (bsc#1057246).
- Allow override system security policy (bsc#1117463).
- asan_build: build ASAN included
- debug_build: build more suitable for debugging
This update was imported from the SUSE:SLE-12:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2018-1520=1
Package List:
- openSUSE Leap 42.3 (i586 x86_64):
ImageMagick-6.8.8.1-79.1
ImageMagick-debuginfo-6.8.8.1-79.1
ImageMagick-debugsource-6.8.8.1-79.1
ImageMagick-devel-6.8.8.1-79.1
ImageMagick-extra-6.8.8.1-79.1
ImageMagick-extra-debuginfo-6.8.8.1-79.1
libMagick++-6_Q16-3-6.8.8.1-79.1
libMagick++-6_Q16-3-debuginfo-6.8.8.1-79.1
libMagick++-devel-6.8.8.1-79.1
libMagickCore-6_Q16-1-6.8.8.1-79.1
libMagickCore-6_Q16-1-debuginfo-6.8.8.1-79.1
libMagickWand-6_Q16-1-6.8.8.1-79.1
libMagickWand-6_Q16-1-debuginfo-6.8.8.1-79.1
perl-PerlMagick-6.8.8.1-79.1
perl-PerlMagick-debuginfo-6.8.8.1-79.1
- openSUSE Leap 42.3 (noarch):
ImageMagick-doc-6.8.8.1-79.1
- openSUSE Leap 42.3 (x86_64):
ImageMagick-devel-32bit-6.8.8.1-79.1
libMagick++-6_Q16-3-32bit-6.8.8.1-79.1
libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-79.1
libMagick++-devel-32bit-6.8.8.1-79.1
libMagickCore-6_Q16-1-32bit-6.8.8.1-79.1
libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-79.1
libMagickWand-6_Q16-1-32bit-6.8.8.1-79.1
libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-79.1
References:
https://www.suse.com/security/cve/CVE-2018-18544.html
https://bugzilla.suse.com/1057246
https://bugzilla.suse.com/1113064
https://bugzilla.suse.com/1117463
--
openSUSE-SU-2018:4055-1: important: Security update for ncurses
openSUSE Security Update: Security update for ncurses
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:4055-1
Rating: important
References: #1103320 #1115929
Cross-References: CVE-2018-19211
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________
An update that solves one vulnerability and has one errata
is now available.
Description:
This update for ncurses fixes the following issues:
Security issue fixed:
- CVE-2018-19211: Fixed denial of service issue that was triggered by a
NULL pointer dereference at function _nc_parse_entry (bsc#1115929).
Non-security issue fixed:
- Remove scree.xterm from terminfo data base as with this screen uses
fallback TERM=screen (bsc#1103320).
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2018-1516=1
Package List:
- openSUSE Leap 15.0 (i586 x86_64):
libncurses5-6.1-lp150.4.3.1
libncurses5-debuginfo-6.1-lp150.4.3.1
libncurses6-6.1-lp150.4.3.1
libncurses6-debuginfo-6.1-lp150.4.3.1
ncurses-debugsource-6.1-lp150.4.3.1
ncurses-devel-6.1-lp150.4.3.1
ncurses-devel-debuginfo-6.1-lp150.4.3.1
ncurses-utils-6.1-lp150.4.3.1
ncurses-utils-debuginfo-6.1-lp150.4.3.1
ncurses5-devel-6.1-lp150.4.3.1
tack-6.1-lp150.4.3.1
tack-debuginfo-6.1-lp150.4.3.1
terminfo-6.1-lp150.4.3.1
terminfo-base-6.1-lp150.4.3.1
terminfo-iterm-6.1-lp150.4.3.1
terminfo-screen-6.1-lp150.4.3.1
- openSUSE Leap 15.0 (x86_64):
libncurses5-32bit-6.1-lp150.4.3.1
libncurses5-32bit-debuginfo-6.1-lp150.4.3.1
libncurses6-32bit-6.1-lp150.4.3.1
libncurses6-32bit-debuginfo-6.1-lp150.4.3.1
ncurses-devel-32bit-6.1-lp150.4.3.1
ncurses-devel-32bit-debuginfo-6.1-lp150.4.3.1
ncurses5-devel-32bit-6.1-lp150.4.3.1
References:
https://www.suse.com/security/cve/CVE-2018-19211.html
https://bugzilla.suse.com/1103320
https://bugzilla.suse.com/1115929
--
openSUSE-SU-2018:4056-1: important: Security update for Chromium
openSUSE Security Update: Security update for Chromium
______________________________________________________________________________
Announcement ID: openSUSE-SU-2018:4056-1
Rating: important
References: #1118529
Cross-References: CVE-2018-17480 CVE-2018-17481 CVE-2018-18335
CVE-2018-18336 CVE-2018-18337 CVE-2018-18338
CVE-2018-18339 CVE-2018-18340 CVE-2018-18341
CVE-2018-18342 CVE-2018-18343 CVE-2018-18344
CVE-2018-18345 CVE-2018-18346 CVE-2018-18347
CVE-2018-18348 CVE-2018-18349 CVE-2018-18350
CVE-2018-18351 CVE-2018-18352 CVE-2018-18353
CVE-2018-18354 CVE-2018-18355 CVE-2018-18356
CVE-2018-18357 CVE-2018-18358 CVE-2018-18359
Affected Products:
openSUSE Leap 15.0
openSUSE Backports SLE-15
______________________________________________________________________________
An update that fixes 27 vulnerabilities is now available.
Description:
This update to Chromium version 71.0.3578.80 fixes security issues and
bugs.
Security issues fixed (boo#1118529):
- CVE-2018-17480: Out of bounds write in V8
- CVE-2018-17481: Use after frees in PDFium
- CVE-2018-18335: Heap buffer overflow in Skia
- CVE-2018-18336: Use after free in PDFium
- CVE-2018-18337: Use after free in Blink
- CVE-2018-18338: Heap buffer overflow in Canvas
- CVE-2018-18339: Use after free in WebAudio
- CVE-2018-18340: Use after free in MediaRecorder
- CVE-2018-18341: Heap buffer overflow in Blink
- CVE-2018-18342: Out of bounds write in V8
- CVE-2018-18343: Use after free in Skia
- CVE-2018-18344: Inappropriate implementation in Extensions
- Multiple issues in SQLite via WebSQL
- CVE-2018-18345: Inappropriate implementation in Site Isolation
- CVE-2018-18346: Incorrect security UI in Blink
- CVE-2018-18347: Inappropriate implementation in Navigation
- CVE-2018-18348: Inappropriate implementation in Omnibox
- CVE-2018-18349: Insufficient policy enforcement in Blink
- CVE-2018-18350: Insufficient policy enforcement in Blink
- CVE-2018-18351: Insufficient policy enforcement in Navigation
- CVE-2018-18352: Inappropriate implementation in Media
- CVE-2018-18353: Inappropriate implementation in Network Authentication
- CVE-2018-18354: Insufficient data validation in Shell Integration
- CVE-2018-18355: Insufficient policy enforcement in URL Formatter
- CVE-2018-18356: Use after free in Skia
- CVE-2018-18357: Insufficient policy enforcement in URL Formatter
- CVE-2018-18358: Insufficient policy enforcement in Proxy
- CVE-2018-18359: Out of bounds read in V8
- Inappropriate implementation in PDFium
- Use after free in Extensions
- Inappropriate implementation in Navigation
- Insufficient policy enforcement in Navigation
- Insufficient policy enforcement in URL Formatter
- Various fixes from internal audits, fuzzing and other initiatives
The following changes are included:
- advertisements posing as error messages are now blocked
- Automatic playing of content at page load mostly disabled
- New JavaScript API for relative time display
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.0:
zypper in -t patch openSUSE-2018-1521=1
- openSUSE Backports SLE-15:
zypper in -t patch openSUSE-2018-1521=1
Package List:
- openSUSE Leap 15.0 (x86_64):
chromedriver-71.0.3578.80-lp150.2.30.1
chromedriver-debuginfo-71.0.3578.80-lp150.2.30.1
chromium-71.0.3578.80-lp150.2.30.1
chromium-debuginfo-71.0.3578.80-lp150.2.30.1
chromium-debugsource-71.0.3578.80-lp150.2.30.1
- openSUSE Backports SLE-15 (aarch64 x86_64):
chromedriver-71.0.3578.80-bp150.2.23.1
chromedriver-debuginfo-71.0.3578.80-bp150.2.23.1
chromium-71.0.3578.80-bp150.2.23.1
chromium-debuginfo-71.0.3578.80-bp150.2.23.1
chromium-debugsource-71.0.3578.80-bp150.2.23.1
References:
https://www.suse.com/security/cve/CVE-2018-17480.html
https://www.suse.com/security/cve/CVE-2018-17481.html
https://www.suse.com/security/cve/CVE-2018-18335.html
https://www.suse.com/security/cve/CVE-2018-18336.html
https://www.suse.com/security/cve/CVE-2018-18337.html
https://www.suse.com/security/cve/CVE-2018-18338.html
https://www.suse.com/security/cve/CVE-2018-18339.html
https://www.suse.com/security/cve/CVE-2018-18340.html
https://www.suse.com/security/cve/CVE-2018-18341.html
https://www.suse.com/security/cve/CVE-2018-18342.html
https://www.suse.com/security/cve/CVE-2018-18343.html
https://www.suse.com/security/cve/CVE-2018-18344.html
https://www.suse.com/security/cve/CVE-2018-18345.html
https://www.suse.com/security/cve/CVE-2018-18346.html
https://www.suse.com/security/cve/CVE-2018-18347.html
https://www.suse.com/security/cve/CVE-2018-18348.html
https://www.suse.com/security/cve/CVE-2018-18349.html
https://www.suse.com/security/cve/CVE-2018-18350.html
https://www.suse.com/security/cve/CVE-2018-18351.html
https://www.suse.com/security/cve/CVE-2018-18352.html
https://www.suse.com/security/cve/CVE-2018-18353.html
https://www.suse.com/security/cve/CVE-2018-18354.html
https://www.suse.com/security/cve/CVE-2018-18355.html
https://www.suse.com/security/cve/CVE-2018-18356.html
https://www.suse.com/security/cve/CVE-2018-18357.html
https://www.suse.com/security/cve/CVE-2018-18358.html
https://www.suse.com/security/cve/CVE-2018-18359.html
https://bugzilla.suse.com/1118529
--
