Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.0874.2
Security update for galera-3, mariadb, mariadb-connector-c
7 June 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: mariadb
Publisher: SUSE
Operating System: SUSE
Impact/Access: Modify Arbitrary Files -- Existing Account
Denial of Service -- Existing Account
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2018-3284 CVE-2018-3282 CVE-2018-3277
CVE-2018-3251 CVE-2018-3200 CVE-2018-3185
CVE-2018-3174 CVE-2018-3173 CVE-2018-3162
CVE-2018-3156 CVE-2018-3143 CVE-2018-3066
CVE-2018-3064 CVE-2018-3063 CVE-2018-3060
CVE-2018-3058 CVE-2016-9843
Reference: ESB-2019.0752
ESB-2019.0721
ESB-2018.3954.2
ESB-2018.3781
Original Bulletin:
https://www.suse.com/support/update/announcement/2019/suse-su-20190628-1.html
https://www.suse.com/support/update/announcement/2019/suse-su-20191441-1.html
Comment: This bulletin contains two (2) SUSE security advisories.
Revision History: June 7 2019: Added advisory 1441 for SUSE OpenStack Cloud 7.
March 19 2019: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
SUSE Security Update: Security update for galera-3, maria
______________________________________________________________________________
Announcement ID: SUSE-SU-2019:0628-1
Rating: important
References: #1013882 #1097938 #1098683 #1101676 #1101677 #1101678
#1103342 #1111858 #1111859 #1112368 #1112377 #1112384
#1112386 #1112391 #1112397 #1112404 #1112415 #1112417
#1112421 #1112432 #1116686 #1118754 #1120041
Cross-References: CVE-2016-9843 CVE-2018-3058 CVE-2018-3060 CVE-2018-3063
CVE-2018-3064 CVE-2018-3066 CVE-2018-3143 CVE-2018-3156
CVE-2018-3162 CVE-2018-3173 CVE-2018-3174 CVE-2018-3185
CVE-2018-3200 CVE-2018-3251 CVE-2018-3277 CVE-2018-3282
CVE-2018-3284
Affected Products:
SUSE OpenStack Cloud Crowbar 8
SUSE OpenStack Cloud 8
HPE Helion Openstack 8
______________________________________________________________________________
An update that solves 17 vulnerabilities and has 6 fixes is now available.
Description:
This update for mariadb, galera-3, mariadb-connector fixes the following
issues:
Security vulnerabilities addressed for mariadb:
o CVE-2016-9843 [bsc#1013882]
o CVE-2018-3058 [bsc#1101676]
o CVE-2018-3060
o CVE-2018-3063 [bsc#1101677]
o CVE-2018-3064 [bsc#1103342]
o CVE-2018-3066 [bsc#1101678]
o CVE-2018-3143 [bsc#1112421]
o CVE-2018-3156 [bsc#1112417]
o CVE-2018-3162 [bsc#1112415]
o CVE-2018-3173 [bsc#1112386]
o CVE-2018-3174 [bsc#1112368]
o CVE-2018-3185 [bsc#1112384]
o CVE-2018-3200 [bsc#1112404]
o CVE-2018-3251 [bsc#1112397]
o CVE-2018-3277 [bsc#1112391]
o CVE-2018-3282 [bsc#1112432]
o CVE-2018-3284 [bsc#1112377]
Other bug fixes and changes for mariadb:
o update to 10.2.21 GA * MDEV-17589 - Stack-buffer-overflow with indexed
varchar (utf8) field * MDEV-16987 - ALTER DATABASE possible in read-only
mode (forbid ALTER DATABASE in read_only) * MDEV-17720 -
slave_ddl_exec_mode=IDEMPOTENT does not handle DROP DATABASE * MDEV-6453 -
Assertion `inited==NONE || (inited==RND && scan)' failed in
handler::ha_rnd_init(bool) with InnoDB, joins, AND/OR conditions *
MDEV-18105 - Mariabackup fails to copy encrypted InnoDB system tablespace
if LSN>4G * MDEV-18041 - Database corruption after renaming a
prefix-indexed column [bsc#1120041] * MDEV-17470 - Orphan temporary files
after interrupted ALTER cause InnoDB: Operating system error number 17 and
eventual fatal error 71 * MDEV-17833: ALTER TABLE is not enforcing prefix
index size limit * MDEV-17989: InnoDB: Failing assertion: dict_tf2_is_valid
(flags, flags2) * MDEV-17765: Locking bug fix for SPATIAL INDEX *
MDEV-17923, MDEV-17904, MDEV-17938: Fixes for FULLTEXT INDEX * Fixes for
regressions introduced in MariaDB Server 10.2.19 by the backup-safe
TRUNCATE TABLE (MDEV-13564, innodb_safe_truncate=ON) and
innodb_undo_log_truncate: * MDEV-17780, MDEV-17816, MDEV-17849, MDEV-17851,
MDEV-17885 * Several improvements to MariaDB Server and backup for dealing
with encrypted or page_compressed pages: * MDEV-12112: corruption in
encrypted table may be overlooked * MDEV-17958: On little-endian systems,
remove bug-compatible
variant of innodb_checksum_algorithm=crc32 * MDEV-17957: Make
innodb_checksum_algorithm stricter for strict_* values * MDEV-18025:
Mariabackup fails to detect corrupted page_compressed=1 tables * release notes
and changelog: - https://mariadb.com/kb/en/library/mariadb-10221-release-notes
- https://mariadb.com/kb/en/library/mariadb-10221-changelog - https://
mariadb.com/kb/en/library/mariadb-10220-release-notes - https://mariadb.com/kb/
en/library/mariadb-10220-changelog
remove PerconaFT from the package as it has AGPL licence (bsc#1118754)
Add patch to link against libatomic where necessary and use C++11 atomics
instead of gcc built-in atomics
update to 10.2.19 GA [bsc#1116686] * innodb_safe_truncate system variable for a
backup-safe TRUNCATE TABLE implementation that is based on RENAME, CREATE, DROP
(MDEV-14717, MDEV-14585, MDEV-13564). Default value for this variable is ON. If
you absolutely must use XtraBackup instead of Mariabackup, you can set it to
OFF and restart the server * MDEV-17289: Multi-pass recovery fails to apply
some redo log records * MDEV-17073: INSERT |ON DUPLICATE KEY UPDATE became more
deadlock-prone * MDEV-17491: micro optimize page_id_t * MDEV-13671: InnoDB
should use case-insensitive column name comparisons like the rest of the server
* Fixes for indexed virtual columns: MDEV-17215, MDEV-16980 * MDEV-17433: Allow
InnoDB start up with empty ib_logfile0 from mariabackup --prepare * MDEV-12547:
InnoDB FULLTEXT index has too strict innodb_ft_result_cache_limit max limit *
MDEV-17541: KILL QUERY during lock wait in FOREIGN KEY check causes hang *
MDEV-17531: Crash in RENAME TABLE with FOREIGN KEY and FULLTEXT INDEX *
MDEV-17532: Performance_schema reports wrong directory for the temporary files
of ALTER TABLE |ALGORITHM=INPLACE * MDEV-17545: Predicate lock for SPATIAL
INDEX should lock non-matching record * MDEV-17546: SPATIAL INDEX should not be
allowed for FOREIGN KEY * MDEV-17548: Incorrect access to off-page column for
indexed virtual column * MDEV-12023: Assertion failure sym_node->table != NULL
on startup * MDEV-17230: encryption_key_id from alter is ignored by encryption
threads * release notes and changelog: - https://mariadb.com/kb/en/library/
mariadb-10219-release-notes - https://mariadb.com/kb/en/library/
mariadb-10219-changelog
do not pack libmariadb.pc (packed in mariadb-connector-c)
add "Requires: libmariadb_plugins" to the mariadb-test subpackage in order to
be able to test client plugins successfuly (bsc#1111859)
don't remove debug_key_management.so anymore (bsc#1111858)
update to 10.2.18 GA * MDEV-15511 - if available, stunnel can be used during
Galera rsync SST * MDEV-16791 - mariabackup: Support DDL commands during backup
* MDEV-13564 - Refuse MLOG_TRUNCATE in mariabackup * MDEV-16934 - add new
system variable eq_range_index_dive_limit to speed up queries that new long
nested IN lists. The default value, for backward compatibility, is 0 meaning
"unlimited". * MDEV-13333 - errors on InnoDB lock conflict * Report all InnoDB
redo log corruption * MDEV-17043 - Purge of indexed virtual columns may cause
hang on table-rebuilding DDL * MDEV-16868 - corruption of InnoDB temporary
tables * MDEV-16465 - Invalid (old) table or database name or hang in
ha_innobase::delete_table and log semaphore wait upon concurrent DDL with
foreign keys * release notes and changelog: - https://mariadb.com/kb/en/library
/mariadb-10218-release-notes - https://mariadb.com/kb/en/library/
mariadb-10218-changelog
update to 10.2.17 GA * New variable innodb_log_optimize_ddl for avoiding delay
due to page flushing and allowing concurrent backup * InnoDB updated to 5.7.23
* MDEV-14637 - Fix hang due to DDL with FOREIGN KEY or persistent statistics *
MDEV-15953 - Alter InnoDB Partitioned Table Moves Files (which were originally
not in the datadir) to the datadir * MDEV-16515 - InnoDB: Failing assertion:
++retries
switch to libedit as control sequences were already fixed there so we don't
have to avoid it (bsc#1098683)
update to 10.2.16 GA * MDEV-13122: mariabackup now supports MyRocks *
MDEV-13779 - InnoDB fails to shut down purge workers, causing hang * MDEV-16267
- Wrong INFORMATION_SCHEMA.INNODB_BUFFER_PAGE.\ TABLE_NAME * MDEV-13834 -
Upgrade failure from 10.1 innodb_encrypt_log * MDEV-16283 - ALTER
TABLE...DISCARD TABLESPACE still takes long on a large buffer pool * MDEV-16376
- ASAN: heap-use-after-free in gcol.innodb_virtual_debug * MDEV-15824 -
innodb_defragment=ON trumps innodb_optimize_fulltext_only=ON in OPTIMIZE TABLE
* MDEV-16124 - fil_rename_tablespace() times out and crashes server during
table-rebuilding ALTER TABLE * MDEV-16416 - Crash on IMPORT TABLESPACE of a
ROW_FORMAT=COMPRESSED table * MDEV-16456 - InnoDB error "returned OS error 71"
complains about wrong path * MDEV-13103 - Deal with page_compressed page
corruption * MDEV-16496 - Mariabackup: Implement --verbose option to instrument
InnoDB log apply * MDEV-16087 - Inconsistent SELECT results when query cache is
enabled * MDEV-15114 - ASAN heap-use-after-free in mem_heap_dup or
dfield_data_is_binary_equal (fix for indexed virtual columns) * release notes
and changelog: - https://mariadb.com/kb/en/library/mariadb-10216-release-notes
- https://mariadb.com/kb/en/library/mariadb-10216-changelog
pack wsrep_sst_rsync_wan file to galera subpackage
Bug fixes and changes for galera-3:
o update to 25.3.24: * A support for new certification key type was added to
allow more relaxed certification rules for foreign key references (galera#
491). * New status variables were added to display the number of open
transactions and referenced client connections inside Galera provider
(galera#492). * GCache was sometimes cleared unnecessarily on startup if
the recovered state had smaller sequence number than the highest found from
GCache. Now only entries with sequence number higher than recovery point
will be cleared (galera#498). * Non-primary configuration is saved into
grastate.dat only when if the node is in closing state (galera#499). *
Exception from GComm was not always handled properly resulting in Galera to
remain in half closed state. This was fixed by propagating the error
condition appropriately to upper layers (galera#500). * A new status
variable displaying the total weight of the cluster nodes was added (galera
#501). * The value of pc.weight did not reflect the actual effective value
after setting it via wsrep_provider_options. This was fixed by making sure
that the new value is taken into use before returning the control back to
caller (galera#505, MDEV-11959) * Use of ECHD algorithms with old OpenSSL
versions was enabled (galera#511). * Default port value is now used by
garbd if the port is not explicitly given in cluster address (MDEV-15531).
* Correct error handling for posix_fallocate(). * Failed causal reads are
retried during configuration changes.
Bug fixes and changes for mariadb-connector-c:
o New upstream version 3.0.6 * MDEV-15263: FIx IS_NUM() macro * CONC-297:
local infile parameter must be unsigned int instead of my_bool * CONC-329:
change return value of internal socket functions from my_bool to int *
CONC-332: my_auth doesn't read/update server ok packet * CONC-344: reset
internal row counter * CONC-345: invalid heap use after free * CONC-346:
Remove old cmake policies * fixed crash in mysql_select_db if NULL
parameter was provided
o New upstream version 3.0.5 * CONC-336: Allow multiple initialization of
client library * Fixed string to MYSQL_TIME conversion (prepared
statements) * CONC-334: Copy all members of MYSQL_FIELD to internal
statement structure * Fixed double free in dynamic column library * Added
checks for corrupted packets in protocol * MDEV-15450: Added default
connection attribute _server_host * CONC-326: fixed wrong openssl thread id
callback
o New upstream version 3.0.4 * Added option
MYSQL_OPT_CAN_HANDLE_EXPIRED_PASSWORDS for mysql_options()/mysql_optionsv
(): * New plugin configuration interface: The default configuration for a
specific plugin can be specified via cmake parameter -DCLIENT_PLUGIN_$
{PLUGIN}=[DYNAMIC|STATIC|OFF]. * Added support for linux abstract socket
(MDEV-15655). * CONC-320: Added asynchronous/non-blocking support for
OpenSSL and GnuTLS * CONC-294: Access violation in mysql_close when using a
connection plugin. * MDEV-14977: If built dynamically the old_password
plugin could not be located due to wrong filename (must be
mysql_old_password.so instead of old_password.so). * CONC-315: If no
default client character set was specified, the utf8 character set will be
used by default (instead of setting the client character set to server
character set) * CONC-317: Parsing of configuration file fails if key/value
pairs contain white spaces. * CONC-322: Correct handling of EAGAIN and
EINPROGRESS in internal_connect (socket) for non windows platforms. *
CONC-323: mariadb_stmt_execute_direct hangs forever if compression used. *
CONC-324: Wrong codepage numbers for some collations. * CONC-326:
ssl_thread_init() uses wrong openssl threadid callback
o Drop libmysqlclient_r Provides from the -devel package. (bsc#1097938)
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
o SUSE OpenStack Cloud Crowbar 8:
zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2019-628=1
o SUSE OpenStack Cloud 8:
zypper in -t patch SUSE-OpenStack-Cloud-8-2019-628=1
o HPE Helion Openstack 8:
zypper in -t patch HPE-Helion-OpenStack-8-2019-628=1
Package List:
o SUSE OpenStack Cloud Crowbar 8 (noarch):
mariadb-errormessages-10.2.21-4.8.1
o SUSE OpenStack Cloud Crowbar 8 (x86_64):
galera-3-debuginfo-25.3.24-4.3.1
galera-3-debugsource-25.3.24-4.3.1
galera-3-wsrep-provider-25.3.24-4.3.1
galera-3-wsrep-provider-debuginfo-25.3.24-4.3.1
libmariadb3-3.0.6-3.6.1
libmariadb3-debuginfo-3.0.6-3.6.1
mariadb-10.2.21-4.8.1
mariadb-client-10.2.21-4.8.1
mariadb-client-debuginfo-10.2.21-4.8.1
mariadb-connector-c-debugsource-3.0.6-3.6.1
mariadb-debuginfo-10.2.21-4.8.1
mariadb-debugsource-10.2.21-4.8.1
mariadb-galera-10.2.21-4.8.1
mariadb-tools-10.2.21-4.8.1
mariadb-tools-debuginfo-10.2.21-4.8.1
o SUSE OpenStack Cloud 8 (noarch):
mariadb-errormessages-10.2.21-4.8.1
o SUSE OpenStack Cloud 8 (x86_64):
galera-3-debuginfo-25.3.24-4.3.1
galera-3-debugsource-25.3.24-4.3.1
galera-3-wsrep-provider-25.3.24-4.3.1
galera-3-wsrep-provider-debuginfo-25.3.24-4.3.1
libmariadb3-3.0.6-3.6.1
libmariadb3-debuginfo-3.0.6-3.6.1
mariadb-10.2.21-4.8.1
mariadb-client-10.2.21-4.8.1
mariadb-client-debuginfo-10.2.21-4.8.1
mariadb-connector-c-debugsource-3.0.6-3.6.1
mariadb-debuginfo-10.2.21-4.8.1
mariadb-debugsource-10.2.21-4.8.1
mariadb-galera-10.2.21-4.8.1
mariadb-tools-10.2.21-4.8.1
mariadb-tools-debuginfo-10.2.21-4.8.1
o HPE Helion Openstack 8 (noarch):
mariadb-errormessages-10.2.21-4.8.1
o HPE Helion Openstack 8 (x86_64):
galera-3-debuginfo-25.3.24-4.3.1
galera-3-debugsource-25.3.24-4.3.1
galera-3-wsrep-provider-25.3.24-4.3.1
galera-3-wsrep-provider-debuginfo-25.3.24-4.3.1
libmariadb3-3.0.6-3.6.1
libmariadb3-debuginfo-3.0.6-3.6.1
mariadb-10.2.21-4.8.1
mariadb-client-10.2.21-4.8.1
mariadb-client-debuginfo-10.2.21-4.8.1
mariadb-connector-c-debugsource-3.0.6-3.6.1
mariadb-debuginfo-10.2.21-4.8.1
mariadb-debugsource-10.2.21-4.8.1
mariadb-galera-10.2.21-4.8.1
mariadb-tools-10.2.21-4.8.1
mariadb-tools-debuginfo-10.2.21-4.8.1
References:
o https://www.suse.com/security/cve/CVE-2016-9843.html
o https://www.suse.com/security/cve/CVE-2018-3058.html
o https://www.suse.com/security/cve/CVE-2018-3060.html
o https://www.suse.com/security/cve/CVE-2018-3063.html
o https://www.suse.com/security/cve/CVE-2018-3064.html
o https://www.suse.com/security/cve/CVE-2018-3066.html
o https://www.suse.com/security/cve/CVE-2018-3143.html
o https://www.suse.com/security/cve/CVE-2018-3156.html
o https://www.suse.com/security/cve/CVE-2018-3162.html
o https://www.suse.com/security/cve/CVE-2018-3173.html
o https://www.suse.com/security/cve/CVE-2018-3174.html
o https://www.suse.com/security/cve/CVE-2018-3185.html
o https://www.suse.com/security/cve/CVE-2018-3200.html
o https://www.suse.com/security/cve/CVE-2018-3251.html
o https://www.suse.com/security/cve/CVE-2018-3277.html
o https://www.suse.com/security/cve/CVE-2018-3282.html
o https://www.suse.com/security/cve/CVE-2018-3284.html
o https://bugzilla.suse.com/1013882
o https://bugzilla.suse.com/1097938
o https://bugzilla.suse.com/1098683
o https://bugzilla.suse.com/1101676
o https://bugzilla.suse.com/1101677
o https://bugzilla.suse.com/1101678
o https://bugzilla.suse.com/1103342
o https://bugzilla.suse.com/1111858
o https://bugzilla.suse.com/1111859
o https://bugzilla.suse.com/1112368
o https://bugzilla.suse.com/1112377
o https://bugzilla.suse.com/1112384
o https://bugzilla.suse.com/1112386
o https://bugzilla.suse.com/1112391
o https://bugzilla.suse.com/1112397
o https://bugzilla.suse.com/1112404
o https://bugzilla.suse.com/1112415
o https://bugzilla.suse.com/1112417
o https://bugzilla.suse.com/1112421
o https://bugzilla.suse.com/1112432
o https://bugzilla.suse.com/1116686
o https://bugzilla.suse.com/1118754
o https://bugzilla.suse.com/1120041
- --------------------------------------------------------------------------------
SUSE Security Update: Recommended update for mariadb, mariadb-connector-c
______________________________________________________________________________
Announcement ID: SUSE-SU-2019:1441-1
Rating: important
References: #1013882 #1064113 #1064114 #1072167 #1101676 #1101677
#1101678 #1103342 #1112368 #1112377 #1112384 #1112386
#1112391 #1112397 #1112404 #1112415 #1112417 #1112421
#1112432 #1112767 #1116686 #1118754 #1120041 #1122198
#1122475 #1127027
Cross-References: CVE-2016-9843 CVE-2017-10320 CVE-2017-10365 CVE-2017-15365
CVE-2018-2759 CVE-2018-2777 CVE-2018-2786 CVE-2018-2810
CVE-2018-3058 CVE-2018-3060 CVE-2018-3063 CVE-2018-3064
CVE-2018-3066 CVE-2018-3143 CVE-2018-3156 CVE-2018-3162
CVE-2018-3173 CVE-2018-3174 CVE-2018-3185 CVE-2018-3200
CVE-2018-3251 CVE-2018-3277 CVE-2018-3282 CVE-2018-3284
Affected Products:
SUSE OpenStack Cloud 7
______________________________________________________________________________
An update that solves 24 vulnerabilities and has two fixes is now available.
Description:
This update for mariadb to version 10.2.22 fixes the following issues:
Security issues fixed:
o Update to MariaDB 10.2.22 GA: * CVE-2019-2510: (bsc#1122198) *
CVE-2019-2537: (bsc#1122198)
o Update to MariaDB 10.2.19 GA (bsc#1116686): * CVE-2018-3282: (bsc#1112432)
* CVE-2016-9843: (bsc#1013882) * CVE-2018-3174: (bsc#1112368) *
CVE-2018-3143: (bsc#1112421) * CVE-2018-3156: (bsc#1112417) *
CVE-2018-3251: (bsc#1112397) * CVE-2018-3185: (bsc#1112384) *
CVE-2018-3277: (bsc#1112391) * CVE-2018-3162: (bsc#1112415) *
CVE-2018-3173: (bsc#1112386) * CVE-2018-3200: (bsc#1112404) *
CVE-2018-3284: (bsc#1112377)
o Update to MariaDB 10.2.18 GA: * CVE-2017-10320: (bsc#1064113) *
CVE-2017-10365: (bsc#1064114) * CVE-2017-15365: (bsc#1072167) *
CVE-2018-3058: (bsc#1101676) * CVE-2018-3063: (bsc#1101677) *
CVE-2018-3064: (bsc#1103342) * CVE-2018-3066: (bsc#1101678) *
CVE-2018-2759, CVE-2018-2777, CVE-2018-2786, CVE-2018-2810, CVE-2018-3060
Other issues fixed:
o Fixed an issue where mysl_install_db fails due to incorrect basedir (bsc#
1127027).
o Fixed an issue where the lograte was not working (bsc#1112767).
o Remove xtrabackup dependency as MariaDB ships a build in mariabackup so
xtrabackup is not needed (bsc#1122475).
o Fixed database corruption after renaming a prefix-indexed column (bsc#
1120041).
o Remove PerconaFT from the package as it has AGPL licence (bsc#1118754).
The complete changelog can be found at: https://mariadb.com/kb/en/library/
mariadb-10222-changelog/
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
o SUSE OpenStack Cloud 7:
zypper in -t patch SUSE-OpenStack-Cloud-7-2019-1441=1
Package List:
o SUSE OpenStack Cloud 7 (aarch64 s390x x86_64):
mariadb-10.2.22-10.1
mariadb-client-10.2.22-10.1
mariadb-client-debuginfo-10.2.22-10.1
mariadb-debuginfo-10.2.22-10.1
mariadb-debugsource-10.2.22-10.1
mariadb-tools-10.2.22-10.1
mariadb-tools-debuginfo-10.2.22-10.1
o SUSE OpenStack Cloud 7 (s390x x86_64):
libmariadb3-3.0.7-1.6.1
o SUSE OpenStack Cloud 7 (noarch):
mariadb-errormessages-10.2.22-10.1
o SUSE OpenStack Cloud 7 (x86_64):
mariadb-galera-10.2.22-10.1
References:
o https://www.suse.com/security/cve/CVE-2016-9843.html
o https://www.suse.com/security/cve/CVE-2017-10320.html
o https://www.suse.com/security/cve/CVE-2017-10365.html
o https://www.suse.com/security/cve/CVE-2017-15365.html
o https://www.suse.com/security/cve/CVE-2018-2759.html
o https://www.suse.com/security/cve/CVE-2018-2777.html
o https://www.suse.com/security/cve/CVE-2018-2786.html
o https://www.suse.com/security/cve/CVE-2018-2810.html
o https://www.suse.com/security/cve/CVE-2018-3058.html
o https://www.suse.com/security/cve/CVE-2018-3060.html
o https://www.suse.com/security/cve/CVE-2018-3063.html
o https://www.suse.com/security/cve/CVE-2018-3064.html
o https://www.suse.com/security/cve/CVE-2018-3066.html
o https://www.suse.com/security/cve/CVE-2018-3143.html
o https://www.suse.com/security/cve/CVE-2018-3156.html
o https://www.suse.com/security/cve/CVE-2018-3162.html
o https://www.suse.com/security/cve/CVE-2018-3173.html
o https://www.suse.com/security/cve/CVE-2018-3174.html
o https://www.suse.com/security/cve/CVE-2018-3185.html
o https://www.suse.com/security/cve/CVE-2018-3200.html
o https://www.suse.com/security/cve/CVE-2018-3251.html
o https://www.suse.com/security/cve/CVE-2018-3277.html
o https://www.suse.com/security/cve/CVE-2018-3282.html
o https://www.suse.com/security/cve/CVE-2018-3284.html
o https://bugzilla.suse.com/1013882
o https://bugzilla.suse.com/1064113
o https://bugzilla.suse.com/1064114
o https://bugzilla.suse.com/1072167
o https://bugzilla.suse.com/1101676
o https://bugzilla.suse.com/1101677
o https://bugzilla.suse.com/1101678
o https://bugzilla.suse.com/1103342
o https://bugzilla.suse.com/1112368
o https://bugzilla.suse.com/1112377
o https://bugzilla.suse.com/1112384
o https://bugzilla.suse.com/1112386
o https://bugzilla.suse.com/1112391
o https://bugzilla.suse.com/1112397
o https://bugzilla.suse.com/1112404
o https://bugzilla.suse.com/1112415
o https://bugzilla.suse.com/1112417
o https://bugzilla.suse.com/1112421
o https://bugzilla.suse.com/1112432
o https://bugzilla.suse.com/1112767
o https://bugzilla.suse.com/1116686
o https://bugzilla.suse.com/1118754
o https://bugzilla.suse.com/1120041
o https://bugzilla.suse.com/1122198
o https://bugzilla.suse.com/1122475
o https://bugzilla.suse.com/1127027
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXPnbcmaOgq3Tt24GAQj6YQ//fJaDP30mEjfxD7UsDgat32di01GuVtAt
3IkJYPuef0LBDpL2CGvbltQ8GZCqu7SOTeJ2vmVqO2mhYOgn7VMAnMf8xZzTNF0J
y6CMBQn6j8eHdpMo5Y12lpUhIv36hhhH5HSWiFiyNk5/I5Jgk1qrx9y87Rl4rEEH
QpYwnUbnOnNK/Mi/NgXoXdSipMwQvUKAV3YphBS1M2Q0MJ6OzPJy1QlDXTX+wc1O
iTxMf6oHQNPafKa/OOj3fmr1oJOeYG3f1g3MFvTrHFbgvgnmuJfci7tUrT+Bgj4p
k24Kn7l5DUbTPsyAUtaGBlAF3tV7iFk2I71bdfoPWUB7fZ5VM0qMfK3IEBn07PUK
KD6B0fSvU1Pb0pBiHVCveBM9qdcCcCB0Hn73ifgL5p6MUOeLwn+1/mgkQxSJJWvW
nv18zf/KPDaxKaFiLGPlWWwe1ayqFknmHbgE2NXCDotqwA9LCUs3aEoCComJI2F6
/4ZHhO3ExTBVSdeBl+PXZAWC9x8UhGx+JEiw6XRgYEODKrEwLtRAHKE+icyZHGmx
spZM+WVyrYhdph0KHaSbcSqn8CtNDUl8v96tfi/dI9UgJsmzgPsleOD3N6VUjOcD
MRYAzjvlBV9a+QqSIHassUKbjxD8N/eECB195MKbQzNY/HCSdO1W2G8keB4wECXI
gw3qMzPFz2o=
=p4Fl
-----END PGP SIGNATURE-----