CVE-2016-9843

The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.

The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.

The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.

Security Fix(es):

inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.(CVE-2016-9840)

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.(CVE-2016-9842)

CVE-2016-9840:inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVE-2016-9841:inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVE-2016-9842:The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers. CVE-2016-9843:The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.(CVE-2016-9843)

The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.

• CVE-2016-9843: avoid pre-decrement of pointer in big-endian CRC calculation

• CVE-2016-9843: avoid pre-decrement of pointer in big-endian CRC calculation

• CVE-2016-9843: avoid pre-decrement of pointer in big-endian CRC calculation

• CVE-2016-9843: avoid pre-decrement of pointer in big-endian CRC calculation

• CVE-2016-9843: avoid pre-decrement of pointer in big-endian CRC calculation

Some easily exploitable vulnerabilities allowing high privileged attacker with network access via multiple protocols to compromise MySQL Server have been fixed.

Updated rsync packages fix security vulnerabilities:

It was discovered that rsync incorrectly handled pointer arithmetic in zlib. An attacker could use this issue to cause rsync to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2016-9840, CVE-2016-9841)

It was discovered that rsync incorrectly handled vectors involving left shifts of negative integers in zlib. An attacker could use this issue to cause rsync to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2016-9842).

It was discovered that rsync incorrectly handled vectors involving big- endian CRC calculation in zlib. An attacker could use this issue to cause rsync to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2016-9843).

Please note, we now compile against system zlib. If rsync fails to sync with older remote systems using compression (-z), you have either update the remote host to a newer version or disable compression.

This update for mariadb to version 10.2.22 fixes the following issues:

Security issues fixed:

• CVE-2019-2510: Fixed a vulnerability which can lead to MySQL compromise and lead to Denial of Service (bsc#1122198).
• CVE-2019-2537: Fixed a vulnerability which can lead to MySQL compromise and lead to Denial of Service (bsc#1122198).
• CVE-2018-3284: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112377)
• CVE-2018-3282: Server Storage Engines unspecified vulnerability (CPU Oct 2018) (bsc#1112432)
• CVE-2018-3277: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112391)
• CVE-2018-3251: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112397)
• CVE-2018-3200: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112404)
• CVE-2018-3185: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112384)
• CVE-2018-3174: Client programs unspecified vulnerability (CPU Oct 2018) (bsc#1112368)
• CVE-2018-3173: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112386)
• CVE-2018-3162: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112415)
• CVE-2018-3156: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112417)
• CVE-2018-3143: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112421)
• CVE-2018-3066: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent Server Options). (bsc#1101678)
• CVE-2018-3064: InnoDB unspecified vulnerability (CPU Jul 2018) (bsc#1103342)
• CVE-2018-3063: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent Server Security Privileges). (bsc#1101677)
• CVE-2018-3058: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent MyISAM). (bsc#1101676)
• CVE-2016-9843: Big-endian out-of-bounds pointer (bsc#1013882)

Non-security issues fixed:

• Fixed an issue where mysl_install_db fails due to incorrect basedir (bsc#1127027).
• Fixed an issue where the lograte was not working (bsc#1112767).
• Backport Information Schema CHECK_CONSTRAINTS Table.
• Maximum value of table_definition_cache is now 2097152.
• InnoDB ALTER TABLE fixes.
• Galera crash recovery fixes.
• Encryption fixes.
• Remove xtrabackup dependency as MariaDB ships a build in mariabackup so xtrabackup is not needed (bsc#1122475).
• Maria DB testsuite - test main.plugin_auth failed (bsc#1111859)
• Maria DB testsuite - test encryption.second_plugin-12863 failed (bsc#1111858)
• Remove PerconaFT from the package as it has AGPL licence (bsc#1118754)
• remove PerconaFT from the package as it has AGPL licence (bsc#1118754)
• Database corruption after renaming a prefix-indexed column (bsc#1120041)

Release notes and changelog:

• https://mariadb.com/kb/en/library/mariadb-10222-release-notes
• https://mariadb.com/kb/en/library/mariadb-10222-changelog/

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the libminizip1-1.2.8-13.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.302-2.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the perl-Compress-Raw-Zlib-2.213-1.1 package on the GA media of openSUSE Tumbleweed.

The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for zlib fixes the following issues:

• Incompatible declarations for external linkage function deflate (bnc#1003577)
• CVE-2016-9842: Undefined Left Shift of Negative Number (bnc#1003580)
• CVE-2016-9840 CVE-2016-9841: Out-of-bounds pointer arithmetic in inftrees.c (bnc#1003579)
• CVE-2016-9843: Big-endian out-of-bounds pointer

This update for zlib fixes the following issues:

CVE-2016-9843: Big-endian out-of-bounds pointer

CVE-2016-9842: Undefined Left Shift of Negative Number (bsc#1003580)

CVE-2016-9840 CVE-2016-9841: Out-of-bounds pointer arithmetic in inftrees.c (bsc#1003579)

Incompatible declarations for external linkage function deflate (bsc#1003577)

This update for zlib fixes the following issues:

CVE-2016-9843: Big-endian out-of-bounds pointer (bsc#1013882)

CVE-2016-9842: Undefined Left Shift of Negative Number (bsc#1003580)

CVE-2016-9840 CVE-2016-9841: Out-of-bounds pointer arithmetic in inftrees.c (bsc#1003579)

Incompatible declarations for external linkage function deflate (bsc#1003577)

This update for java-1_7_0-ibm fixes the following issues:

Version update to 7.0-10.5 bsc#1038505

• CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c
• CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c
• CVE-2016-9842: zlib: Undefined left shift of negative number
• CVE-2016-9843: zlib: Big-endian out-of-bounds pointer
• CVE-2017-1289: IBM JDK: XML External Entity Injection (XXE) error when processing XML data
• CVE-2017-3509: OpenJDK: improper re-use of NTLM authenticated connections
• CVE-2017-3511: OpenJDK: untrusted extension directories search path in Launcher
• CVE-2017-3539: OpenJDK: MD5 allowed for jar verification
• CVE-2017-3533: OpenJDK: newline injection in the FTP client
• CVE-2017-3544: OpenJDK: newline injection in the SMTP client

This update for java-1_7_1-ibm fixes the following issues:

• Version update to 7.1-4.5 bsc#1038505

  • CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c
  • CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c
  • CVE-2016-9842: zlib: Undefined left shift of negative number
  • CVE-2016-9843: zlib: Big-endian out-of-bounds pointer
  • CVE-2017-1289: IBM JDK: XML External Entity Injection (XXE) error when processing XML data
  • CVE-2017-3509: OpenJDK: improper re-use of NTLM authenticated connections
  • CVE-2017-3511: OpenJDK: untrusted extension directories search path in Launcher
  • CVE-2017-3539: OpenJDK: MD5 allowed for jar verification
  • CVE-2017-3533: OpenJDK: newline injection in the FTP client
  • CVE-2017-3544: OpenJDK: newline injection in the SMTP client

This update for java-1_8_0-ibm fixes the following issues:

Version update bsc#1038505:

• CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c
• CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c
• CVE-2016-9842: zlib: Undefined left shift of negative number
• CVE-2016-9843: zlib: Big-endian out-of-bounds pointer
• CVE-2017-3544: OpenJDK: newline injection in the SMTP client
• CVE-2017-3509: OpenJDK: improper re-use of NTLM authenticated connections
• CVE-2017-3511: OpenJDK: untrusted extension directories search path in Launcher
• CVE-2017-3533: OpenJDK: newline injection in the FTP client
• CVE-2017-3539: OpenJDK: MD5 allowed for jar verification
• CVE-2017-1289: IBM JDK: XML External Entity Injection (XXE) error when processing XML data

This update for java-1_7_1-ibm fixes the following issues:

Version update to 7.1-4.5 bsc#1038505

• CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c
• CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c
• CVE-2016-9842: zlib: Undefined left shift of negative number
• CVE-2016-9843: zlib: Big-endian out-of-bounds pointer
• CVE-2017-1289: IBM JDK: XML External Entity Injection (XXE) error when processing XML data
• CVE-2017-3509: OpenJDK: improper re-use of NTLM authenticated connections
• CVE-2017-3511: OpenJDK: untrusted extension directories search path in Launcher
• CVE-2017-3539: OpenJDK: MD5 allowed for jar verification
• CVE-2017-3533: OpenJDK: newline injection in the FTP client
• CVE-2017-3544: OpenJDK: newline injection in the SMTP client

This update for java-1_6_0-ibm fixes the following issues:

• Version update to 6.0-16.45 bsc#1038505

  • CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c
  • CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c
  • CVE-2016-9842: zlib: Undefined left shift of negative number
  • CVE-2016-9843: zlib: Big-endian out-of-bounds pointer
  • CVE-2017-1289: IBM JDK: XML External Entity Injection (XXE) error when processing XML data
  • CVE-2017-3509: OpenJDK: improper re-use of NTLM authenticated connections
  • CVE-2017-3539: OpenJDK: MD5 allowed for jar verification
  • CVE-2017-3533: OpenJDK: newline injection in the FTP client
  • CVE-2017-3544: OpenJDK: newline injection in the SMTP client

• Version update to 6.0-16.40 bsc#1027038 CVE-2016-2183

This update for java-1_6_0-ibm fixes the following issues:

• CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c

• CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c

• CVE-2016-9842: zlib: Undefined left shift of negative number

• CVE-2016-9843: zlib: Big-endian out-of-bounds pointer

• CVE-2017-1289: IBM JDK: XML External Entity Injection (XXE) error when processing XML data

• CVE-2017-3509: OpenJDK: improper re-use of NTLM authenticated connections

• CVE-2017-3539: OpenJDK: MD5 allowed for jar verification

• CVE-2017-3533: OpenJDK: newline injection in the FTP client

• CVE-2017-3544: OpenJDK: newline injection in the SMTP client

• Version update to 6.0-16.40 bsc#1027038 CVE-2016-2183

The SUSE Linux Enterprise Server 12 container image has been updated to include security and stability fixes.

The following issues related to building of the container images have been fixed:

• Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)
• Do not install recommended packages when building container images. (bsc#975726)

A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 are now included in the base image. A package/CVE cross-reference is available below.

pam:

• CVE-2015-3238

libtasn1:

• CVE-2015-3622
• CVE-2016-4008

libidn:

• CVE-2015-2059
• CVE-2015-8948
• CVE-2016-6261
• CVE-2016-6262
• CVE-2016-6263

zlib:

• CVE-2016-9840
• CVE-2016-9841
• CVE-2016-9842
• CVE-2016-9843

curl:

• CVE-2016-5419
• CVE-2016-5420
• CVE-2016-5421
• CVE-2016-7141
• CVE-2016-7167
• CVE-2016-8615
• CVE-2016-8616
• CVE-2016-8617
• CVE-2016-8618
• CVE-2016-8619
• CVE-2016-8620
• CVE-2016-8621
• CVE-2016-8622
• CVE-2016-8623
• CVE-2016-8624
• CVE-2016-9586
• CVE-2017-1000100
• CVE-2017-1000101
• CVE-2017-7407

openssl:

• CVE-2016-2105
• CVE-2016-2106
• CVE-2016-2107
• CVE-2016-2108
• CVE-2016-2109
• CVE-2016-2177
• CVE-2016-2178
• CVE-2016-2179
• CVE-2016-2180
• CVE-2016-2181
• CVE-2016-2182
• CVE-2016-2183
• CVE-2016-6302
• CVE-2016-6303
• CVE-2016-6304
• CVE-2016-6306

libxml2:

• CVE-2014-0191
• CVE-2015-8806
• CVE-2016-1762
• CVE-2016-1833
• CVE-2016-1834
• CVE-2016-1835
• CVE-2016-1837
• CVE-2016-1838
• CVE-2016-1839
• CVE-2016-1840
• CVE-2016-2073
• CVE-2016-3627
• CVE-2016-3705
• CVE-2016-4447
• CVE-2016-4448
• CVE-2016-4449
• CVE-2016-4483
• CVE-2016-4658
• CVE-2016-9318
• CVE-2016-9597
• CVE-2017-9047
• CVE-2017-9048
• CVE-2017-9049
• CVE-2017-9050

util-linux:

• CVE-2015-5218
• CVE-2016-5011
• CVE-2017-2616

cracklib:

• CVE-2016-6318

systemd:

• CVE-2014-9770
• CVE-2015-8842
• CVE-2016-7796

pcre:

• CVE-2014-8964
• CVE-2015-2325
• CVE-2015-2327
• CVE-2015-2328
• CVE-2015-3210
• CVE-2015-3217
• CVE-2015-5073
• CVE-2015-8380
• CVE-2015-8381
• CVE-2015-8382
• CVE-2015-8383
• CVE-2015-8384
• CVE-2015-8385
• CVE-2015-8386
• CVE-2015-8387
• CVE-2015-8388
• CVE-2015-8389
• CVE-2015-8390
• CVE-2015-8391
• CVE-2015-8392
• CVE-2015-8393
• CVE-2015-8394
• CVE-2015-8395
• CVE-2016-1283
• CVE-2016-3191

appamor:

• CVE-2017-6507

bash:

• CVE-2014-6277
• CVE-2014-6278
• CVE-2016-0634
• CVE-2016-7543

cpio:

• CVE-2016-2037

glibc:

• CVE-2016-1234
• CVE-2016-3075
• CVE-2016-3706
• CVE-2016-4429
• CVE-2017-1000366

perl:

• CVE-2015-8853
• CVE-2016-1238
• CVE-2016-2381
• CVE-2016-6185

libssh2_org:

• CVE-2016-0787

expat:

• CVE-2012-6702
• CVE-2015-1283
• CVE-2016-0718
• CVE-2016-5300
• CVE-2016-9063
• CVE-2017-9233

ncurses:

• CVE-2017-10684
• CVE-2017-10685
• CVE-2017-11112
• CVE-2017-11113

libksba:

• CVE-2016-4574
• CVE-2016-4579

libgcrypt:

• CVE-2015-7511
• CVE-2016-6313
• CVE-2017-7526

dbus-1:

• CVE-2014-7824
• CVE-2015-0245

Finally, the following packages received non-security fixes:

• augeas
• bzip2
• ca-certificates-mozilla
• coreutils
• cryptsetup
• cyrus-sasl
• dirmngr
• e2fsprogs
• findutils
• gpg2
• insserv-compat
• kmod
• libcap
• libsolv
• libzypp
• openldap2
• p11-kit
• permissions
• procps
• rpm
• sed
• shadow
• zypper

The SUSE Linux Enterprise Server 12 SP1 container image has been updated to include security and stability fixes.

The following issues related to building of the container images have been fixed:

• Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)
• Do not install recommended packages when building container images. (bsc#975726)

A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 SP1 are now included in the base image. A package/CVE cross-reference is available below.

pam:

• CVE-2015-3238

libtasn1:

• CVE-2015-3622
• CVE-2016-4008

expat:

expat:

• CVE-2012-6702
• CVE-2015-1283
• CVE-2016-0718
• CVE-2016-5300
• CVE-2016-9063
• CVE-2017-9233

libidn:

• CVE-2015-2059
• CVE-2015-8948
• CVE-2016-6261
• CVE-2016-6262
• CVE-2016-6263

zlib:

• CVE-2016-9840
• CVE-2016-9841
• CVE-2016-9842
• CVE-2016-9843

curl:

• CVE-2016-5419
• CVE-2016-5420
• CVE-2016-5421
• CVE-2016-7141
• CVE-2016-7167
• CVE-2016-8615
• CVE-2016-8616
• CVE-2016-8617
• CVE-2016-8618
• CVE-2016-8619
• CVE-2016-8620
• CVE-2016-8621
• CVE-2016-8622
• CVE-2016-8623
• CVE-2016-8624
• CVE-2016-9586
• CVE-2017-1000100
• CVE-2017-1000101
• CVE-2017-7407

openssl:

• CVE-2016-2105
• CVE-2016-2106
• CVE-2016-2107
• CVE-2016-2108
• CVE-2016-2109
• CVE-2016-2177
• CVE-2016-2178
• CVE-2016-2179
• CVE-2016-2180
• CVE-2016-2181
• CVE-2016-2182
• CVE-2016-2183
• CVE-2016-6302
• CVE-2016-6303
• CVE-2016-6304
• CVE-2016-6306
• CVE-2016-7056
• CVE-2016-8610
• CVE-2017-3731

cracklib:

• CVE-2016-6318

pcre:

• CVE-2014-8964
• CVE-2015-2325
• CVE-2015-2327
• CVE-2015-2328
• CVE-2015-3210
• CVE-2015-3217
• CVE-2015-5073
• CVE-2015-8380
• CVE-2015-8381
• CVE-2015-8382
• CVE-2015-8383
• CVE-2015-8384
• CVE-2015-8385
• CVE-2015-8386
• CVE-2015-8387
• CVE-2015-8388
• CVE-2015-8389
• CVE-2015-8390
• CVE-2015-8391
• CVE-2015-8392
• CVE-2015-8393
• CVE-2015-8394
• CVE-2015-8395
• CVE-2016-1283
• CVE-2016-3191

appamor:

• CVE-2017-6507

bash:

• CVE-2014-6277
• CVE-2014-6278
• CVE-2016-0634
• CVE-2016-7543

cpio:

• CVE-2016-2037

glibc:

• CVE-2016-1234
• CVE-2016-3075
• CVE-2016-3706
• CVE-2016-4429
• CVE-2017-1000366

perl:

• CVE-2015-8853
• CVE-2016-1238
• CVE-2016-2381
• CVE-2016-6185

libssh2_org:

• CVE-2016-0787

util-linux:

• CVE-2016-5011
• CVE-2017-2616

ncurses:

• CVE-2017-10684
• CVE-2017-10685
• CVE-2017-11112
• CVE-2017-11113

libksba:

• CVE-2016-4574
• CVE-2016-4579

libxml2:

• CVE-2014-0191
• CVE-2015-8806
• CVE-2016-1762
• CVE-2016-1833
• CVE-2016-1834
• CVE-2016-1835
• CVE-2016-1837
• CVE-2016-1838
• CVE-2016-1839
• CVE-2016-1840
• CVE-2016-2073
• CVE-2016-3627
• CVE-2016-3705
• CVE-2016-4447
• CVE-2016-4448
• CVE-2016-4449
• CVE-2016-4483
• CVE-2016-4658
• CVE-2016-9318
• CVE-2016-9597
• CVE-2017-9047
• CVE-2017-9048
• CVE-2017-9049
• CVE-2017-9050

libgcrypt:

• CVE-2015-7511
• CVE-2016-6313
• CVE-2017-7526

update-alternatives:

• CVE-2015-0860

systemd:

• CVE-2014-9770
• CVE-2015-8842
• CVE-2016-7796

dbus-1:

• CVE-2014-7824
• CVE-2015-0245

Finally, the following packages received non-security fixes:

• augeas
• bzip2
• ca-certificates-mozilla
• coreutils
• cryptsetup
• cyrus-sasl
• dirmngr
• e2fsprogs
• findutils
• gpg2
• insserv-compat
• kmod
• libcap
• libsolv
• libzypp
• lua51
• lvm2
• netcfg
• p11-kit
• permissions
• procps
• rpm
• sed
• sg3_utils
• shadow
• zypper

This update for java-1_8_0-openjdk fixes the following issues:

• Update to version jdk8u151 (icedtea 3.6.0)

Security issues fixed:

• CVE-2017-10274: Handle smartcard clean up better (bsc#1064071)
• CVE-2017-10281: Better queuing priorities (bsc#1064072)
• CVE-2017-10285: Unreferenced references (bsc#1064073)
• CVE-2017-10295: Better URL connections (bsc#1064075)
• CVE-2017-10388: Correct Kerberos ticket grants (bsc#1064086)
• CVE-2017-10346: Better invokespecial checks (bsc#1064078)
• CVE-2017-10350: Better Base Exceptions (bsc#1064082)
• CVE-2017-10347: Better timezone processing (bsc#1064079)
• CVE-2017-10349: Better X processing (bsc#1064081)
• CVE-2017-10345: Better keystore handling (bsc#1064077)
• CVE-2017-10348: Better processing of unresolved permissions (bsc#1064080)
• CVE-2017-10357: Process Proxy presentation (bsc#1064085)
• CVE-2017-10355: More stable connection processing (bsc#1064083)
• CVE-2017-10356: Update storage implementations (bsc#1064084)
• CVE-2016-10165: Improve CMS header processing (bsc#1064069)
• CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843: Upgrade compression library (bsc#1064070)

Bug fixes:

• Fix bsc#1032647, bsc#1052009 with btrfs subvolumes and overlayfs

This update for java-1_7_0-openjdk fixes the following issues:

Security issues fixed:

• CVE-2017-10356: Fix issue inside subcomponent Security (bsc#1064084).
• CVE-2017-10274: Fix issue inside subcomponent Smart Card IO (bsc#1064071).
• CVE-2017-10281: Fix issue inside subcomponent Serialization (bsc#1064072).
• CVE-2017-10285: Fix issue inside subcomponent RMI (bsc#1064073).
• CVE-2017-10295: Fix issue inside subcomponent Networking (bsc#1064075).
• CVE-2017-10388: Fix issue inside subcomponent Libraries (bsc#1064086).
• CVE-2017-10346: Fix issue inside subcomponent Hotspot (bsc#1064078).
• CVE-2017-10350: Fix issue inside subcomponent JAX-WS (bsc#1064082).
• CVE-2017-10347: Fix issue inside subcomponent Serialization (bsc#1064079).
• CVE-2017-10349: Fix issue inside subcomponent JAXP (bsc#1064081).
• CVE-2017-10345: Fix issue inside subcomponent Serialization (bsc#1064077).
• CVE-2017-10348: Fix issue inside subcomponent Libraries (bsc#1064080).
• CVE-2017-10357: Fix issue inside subcomponent Serialization (bsc#1064085).
• CVE-2017-10355: Fix issue inside subcomponent Networking (bsc#1064083).
• CVE-2017-10102: Fix incorrect handling of references in DGC (bsc#1049316).
• CVE-2017-10053: Fix reading of unprocessed image data in JPEGImageReader (bsc#1049305).
• CVE-2017-10067: Fix JAR verifier incorrect handling of missing digest (bsc#1049306).
• CVE-2017-10081: Fix incorrect bracket processing in function signature handling (bsc#1049309).
• CVE-2017-10087: Fix insufficient access control checks in ThreadPoolExecutor (bsc#1049311).
• CVE-2017-10089: Fix insufficient access control checks in ServiceRegistry (bsc#1049312).
• CVE-2017-10090: Fix insufficient access control checks in AsynchronousChannelGroupImpl (bsc#1049313).
• CVE-2017-10096: Fix insufficient access control checks in XML transformations (bsc#1049314).
• CVE-2017-10101: Fix unrestricted access to com.sun.org.apache.xml.internal.resolver (bsc#1049315).
• CVE-2017-10107: Fix insufficient access control checks in ActivationID (bsc#1049318).
• CVE-2017-10074: Fix integer overflows in range check loop predicates (bsc#1049307).
• CVE-2017-10110: Fix insufficient access control checks in ImageWatched (bsc#1049321).
• CVE-2017-10108: Fix unbounded memory allocation in BasicAttribute deserialization (bsc#1049319).
• CVE-2017-10109: Fix unbounded memory allocation in CodeSource deserialization (bsc#1049320).
• CVE-2017-10115: Fix unspecified vulnerability in subcomponent JCE (bsc#1049324).
• CVE-2017-10118: Fix ECDSA implementation timing attack (bsc#1049326).
• CVE-2017-10116: Fix LDAPCertStore following referrals to non-LDAP URL (bsc#1049325).
• CVE-2017-10135: Fix PKCS#8 implementation timing attack (bsc#1049328).
• CVE-2017-10176: Fix incorrect handling of certain EC points (bsc#1049329).
• CVE-2017-10074: Fix integer overflows in range check loop predicates (bsc#1049307).
• CVE-2017-10074: Fix integer overflows in range check loop predicates (bsc#1049307).
• CVE-2017-10111: Fix checks in LambdaFormEditor (bsc#1049322).
• CVE-2017-10243: Fix unspecified vulnerability in subcomponent JAX-WS (bsc#1049332).
• CVE-2017-10125: Fix unspecified vulnerability in subcomponent deployment (bsc#1049327).
• CVE-2017-10114: Fix unspecified vulnerability in subcomponent JavaFX (bsc#1049323).
• CVE-2017-10105: Fix unspecified vulnerability in subcomponent deployment (bsc#1049317).
• CVE-2017-10086: Fix unspecified in subcomponent JavaFX (bsc#1049310).
• CVE-2017-10198: Fix incorrect enforcement of certificate path restrictions (bsc#1049331).
• CVE-2017-10193: Fix incorrect key size constraint check (bsc#1049330).

Bug fixes:

• Drop Exec Shield workaround to fix crashes on recent kernels, where Exec Shield is gone (bsc#1052318).

This update brings zlib to 1.2.7, bringing bugfixes and speedups.

It also reduces a buildtime issue with clamav 0.100 which caused hangs on 32bit platforms. (bsc#1095016)

MySQL server was updated to version 5.5.62, fixing bugs and security issues.

Changes:

http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-62.html

Following security issues were fixed:

• CVE-2016-9843: The crc32_big function in zlib might have allowed context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation. (bsc#1013882) Please note that SUSE uses the system zlib, not the embedded copy.

• CVE-2018-3133: Authenticated low privilege attackers could cause denial of service attacks (hangs or crashes) against the mysql server (bsc#1112369)

• CVE-2018-3174: Authenticated high privilege attackers could cause denial of service attacks (hangs or crashes) against the mysql server (bsc#1112368)

• CVE-2018-3282: Authenticated high privilege attackers could cause denial of service attacks (hangs or crashes) against the mysql server (bsc#1112432)

This update for mariadb fixes the following issues:

Update to MariaDB 10.0.37 GA (bsc#1116686).

Security issues fixed:

• CVE-2018-3282: Server Storage Engines unspecified vulnerability (CPU Oct 2018) (bsc#1112432)
• CVE-2018-3251: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112397)
• CVE-2018-3174: Client programs unspecified vulnerability (CPU Oct 2018) (bsc#1112368)
• CVE-2018-3156: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112417)
• CVE-2018-3143: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112421)
• CVE-2018-3066: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent Server Options). (bsc#1101678)
• CVE-2018-3064: InnoDB unspecified vulnerability (CPU Jul 2018) (bsc#1103342)
• CVE-2018-3063: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent Server Security Privileges). (bsc#1101677)
• CVE-2018-3058: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent MyISAM). (bsc#1101676)
• CVE-2016-9843: Big-endian out-of-bounds pointer (bsc#1013882)

Release notes and changelog:

• https://kb.askmonty.org/en/mariadb-10037-release-notes
• https://kb.askmonty.org/en/mariadb-10037-changelog
• https://kb.askmonty.org/en/mariadb-10036-release-notes
• https://kb.askmonty.org/en/mariadb-10036-changelog

This update for mariadb fixes the following issues:

Update to MariaDB 10.0.37 GA (bsc#1116686).

Security issues fixed:

• CVE-2018-3282: Server Storage Engines unspecified vulnerability (CPU Oct 2018) (bsc#1112432)
• CVE-2018-3251: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112397)
• CVE-2018-3174: Client programs unspecified vulnerability (CPU Oct 2018) (bsc#1112368)
• CVE-2018-3156: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112417)
• CVE-2018-3143: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112421)
• CVE-2018-3066: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent Server Options). (bsc#1101678)
• CVE-2018-3064: InnoDB unspecified vulnerability (CPU Jul 2018) (bsc#1103342)
• CVE-2018-3063: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent Server Security Privileges). (bsc#1101677)
• CVE-2018-3058: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent MyISAM). (bsc#1101676)
• CVE-2016-9843: Big-endian out-of-bounds pointer (bsc#1013882)

Non-security changes:

• Remove PerconaFT from the package as it has AGPL licence (bsc#1118754)
• do not just remove tokudb plugin but don't build it at all (missing jemalloc dependency)

Release notes and changelog:

• https://kb.askmonty.org/en/mariadb-10037-release-notes
• https://kb.askmonty.org/en/mariadb-10037-changelog
• https://kb.askmonty.org/en/mariadb-10036-release-notes
• https://kb.askmonty.org/en/mariadb-10036-changelog

This update for mariadb to version 10.2.19 fixes the following issues: (bsc#1116686)

Security issues fixed:

• CVE-2016-9843: Big-endian out-of-bounds pointer (bsc#1013882)
• CVE-2018-3282, CVE-2018-3174, CVE-2018-3143, CVE-2018-3156, CVE-2018-3251, CVE-2018-3185, CVE-2018-3277, CVE-2018-3162, CVE-2018-3173, CVE-2018-3200, CVE-2018-3284: Fixed multiple denial of service vulnerabilities (bsc#1112432, bsc#1112368, bsc#1112421, bsc#1112417, bsc#1112397, bsc#1112391, bsc#1112415, bsc#1112386, bsc#1112404, bsc#1112377, bsc#1112384)

Non-security issues fixed:

• Fixed database corruption after renaming a prefix-indexed column (bsc#1120041)
• Remove PerconaFT from the package as it has a AGPL license (bsc#1118754)
• Enable testing for client plugins (bsc#1111859)
• Improve test coverage by keeping debug_key_management.so (bsc#1111858)

This update for mariadb to version 10.2.22 fixes the following issues:

Security issues fixed:

• CVE-2019-2510: Fixed a vulnerability which can lead to MySQL compromise and lead to Denial of Service (bsc#1122198).
• CVE-2019-2537: Fixed a vulnerability which can lead to MySQL compromise and lead to Denial of Service (bsc#1122198).
• CVE-2018-3284: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112377)
• CVE-2018-3282: Server Storage Engines unspecified vulnerability (CPU Oct 2018) (bsc#1112432)
• CVE-2018-3277: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112391)
• CVE-2018-3251: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112397)
• CVE-2018-3200: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112404)
• CVE-2018-3185: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112384)
• CVE-2018-3174: Client programs unspecified vulnerability (CPU Oct 2018) (bsc#1112368)
• CVE-2018-3173: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112386)
• CVE-2018-3162: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112415)
• CVE-2018-3156: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112417)
• CVE-2018-3143: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112421)
• CVE-2018-3066: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent Server Options). (bsc#1101678)
• CVE-2018-3064: InnoDB unspecified vulnerability (CPU Jul 2018) (bsc#1103342)
• CVE-2018-3063: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent Server Security Privileges). (bsc#1101677)
• CVE-2018-3058: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent MyISAM). (bsc#1101676)
• CVE-2016-9843: Big-endian out-of-bounds pointer (bsc#1013882)

Non-security issues fixed:

• Fixed an issue where mysl_install_db fails due to incorrect basedir (bsc#1127027).
• Fixed an issue where the lograte was not working (bsc#1112767).
• Backport Information Schema CHECK_CONSTRAINTS Table.
• Maximum value of table_definition_cache is now 2097152.
• InnoDB ALTER TABLE fixes.
• Galera crash recovery fixes.
• Encryption fixes.
• Remove xtrabackup dependency as MariaDB ships a build in mariabackup so xtrabackup is not needed (bsc#1122475).
• Maria DB testsuite - test main.plugin_auth failed (bsc#1111859)
• Maria DB testsuite - test encryption.second_plugin-12863 failed (bsc#1111858)
• Remove PerconaFT from the package as it has AGPL licence (bsc#1118754)
• remove PerconaFT from the package as it has AGPL licence (bsc#1118754)
• Database corruption after renaming a prefix-indexed column (bsc#1120041)

Release notes and changelog:

• https://mariadb.com/kb/en/library/mariadb-10222-release-notes
• https://mariadb.com/kb/en/library/mariadb-10222-changelog/