Thank you for reading the Linux Advisory Watch Security Newsletter. The purpose of this document is to provide our readers with a quick summary of each week's vendor security bulletins and pointers on methods to improve the security posture of your open source system. Vulnerabilities affect nearly every vendor virtually every week, so be sure to read through to find the updates your distributor have made available.

LinuxSecurity.com Feature Extras:

- Social engineering is the practice of learning and obtaining valuable information by exploiting human vulnerabilities. It is an art of deception that is considered to be vital for a penetration tester when there is a lack of information about the target that can be exploited.

- When you’re dealing with a security incident it’s essential you – and the rest of your team – not only have the skills they need to comprehensively deal with an issue, but also have a framework to support them as they approach it. This framework means they can focus purely on what they need to do, following a process that removes any vulnerabilities and threats in a proper way – so everyone who depends upon the software you protect can be confident that it’s secure and functioning properly.

  (Feb 10)
 

Lalith Rallabhandi discovered that OmniAuth, a Ruby library for implementing multi-provider authentication in web applications, mishandled and leaked sensitive information. An attacker with access to the callback environment, such as in the case of a crafted web
  (Feb 9)
 

A regression was detected in the previously issued fix for CVE-2018-6360. The patch released with DSA 4105-1 broke the feature of invoking mpv with raw YouTube ids. This update fixes this functionality issue. For reference, the relevant part of the original advisory text follows.
  (Feb 7)
 

It was discovered that the webhook validation of Anymail, a Django email backends for multiple ESPs, is prone to a timing attack. A remote attacker can take advantage of this flaw to obtain a WEBHOOK_AUTHORIZATION secret and post arbitrary email tracking events.
  (Feb 7)
 

Two vulnerabilities were discovered in Libtasn1, a library to manage ASN.1 structures, allowing a remote attacker to cause a denial of service against an application using the Libtasn1 library.
  (Feb 7)
 

It was discovered that mpv, a media player, was vulnerable to remote code execution attacks. An attacker could craft a malicious web page that, when used as an argument in mpv, could execute arbitrary code in the host of the mpv user.
  (Feb 4)
 

'landave' discovered a heap-based buffer overflow vulnerability in the NCompress::NShrink::CDecoder::CodeReal method in p7zip, a 7zr file archiver with high compression ratio. A remote attacker can take advantage of this flaw to cause a denial-of-service or, potentially the
  Fedora 27: tomcat-native Security Update (Feb 9)
 

Security fix for CVE-2017-15698
  Fedora 26: tomcat-native Security Update (Feb 9)
 

Security fix for CVE-2017-15698
  Fedora 27: w3m Security Update (Feb 8)
 

Rebase to latest upstream gitrev 20180125 and Security fix for CVE-2018-6196, CVE-2018-6197, CVE-2018-6198
  Fedora 27: jackson-databind Security Update (Feb 7)
 

Security fixes for CVE-2017-17485 and CVE-2018-5968.
  Fedora 26: jackson-databind Security Update (Feb 7)
 

Security fixes for CVE-2017-17485 and CVE-2018-5968.
  Fedora 27: p7zip Security Update (Feb 6)
 

Security fix for CVE-2017-17969 (from Debian)
  Fedora 27: rsync Security Update (Feb 6)
 

New version 3.1.3, includes security fix for CVE-2018-5764
  Fedora 27: thunderbird Security Update (Feb 6)
 

Update to latest upstream stable version.
  Fedora 27: flatpak Security Update (Feb 6)
 

This is a security fix release that fixes a sandbox escape in the flatpak dbus proxy. This issue was found by Gabriel Campana of The Google Security Team. Major changes in 0.10.3 * Fix dbus proxy vulnerability in authentication phase * Make permission handling ignore unknown permissions for forwards compatibility * Removed incorrect error message in update --appdata when ther
  Fedora 27: tomcat Security Update (Feb 6)
 

This update includes a rebase from 8.0.47 to 8.0.49.
  Fedora 27: zziplib Security Update (Feb 6)
 

Security fix for CVE-2018-6381
  Fedora 27: squid Security Update (Feb 6)
 

Bugfix + security update
  Fedora 27: mupdf Security Update (Feb 6)
 

CVE-2017-17858 (rh bz #1537952) (gs bz #698819) CVE-2018-5686 (rh bz #1539854) gs bz #698860)
  Fedora 27: community-mysql Security Update (Feb 6)
 

**MySQL 5.7.21** Bugs fixed: https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-21.html CVE fixed: https://www.oracle.com/security-alerts/cpujan2018.html CVE-2018-2696 CVE-2018-2703 CVE-2018-2565 CVE-2018-2573 CVE-2018-2576 CVE-2018-2583 CVE-2018-2586 CVE-2018-2590 CVE-2018-2600 CVE-2018-2612
  Fedora 26: clamav Security Update (Feb 6)
 

ClamAV 0.99.3 recommended for all ClamAV users. Please see details below: 1. ClamAV UAF (use-after-free) Vulnerabilities (CVE-2017-12374) --------------------------------------------------------------- The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could
  Fedora 26: flatpak Security Update (Feb 6)
 

This is a security fix release that fixes a sandbox escape in the flatpak dbus proxy. This issue was found by Gabriel Campana of The Google Security Team. Major changes in 0.10.3 * Fix dbus proxy vulnerability in authentication phase * Make permission handling ignore unknown permissions for forwards compatibility * Removed incorrect error message in update --appdata when ther
  Fedora 26: p7zip Security Update (Feb 6)
 

Security fix for CVE-2017-17969 (from Debian)
  Fedora 26: libtasn1 Security Update (Feb 6)
 

Update to 4.13 (#1535261)
  Fedora 26: dnsmasq Security Update (Feb 6)
 

DNSSEC fix for wildcard NSEC records (CVE-2017-15107)
  Fedora 26: unbound Security Update (Feb 6)
 

Security fix for CVE-2017-15105
  Fedora 26: mupdf Security Update (Feb 6)
 

CVE-2017-17858 (rh bz #1537952) (gs bz #698819) CVE-2018-5686 (gs bz #698860)
  Fedora 26: rsync Security Update (Feb 5)
 

Removing dependencies on systemd-units ---- New version 3.1.3, includes security fix for CVE-2018-5764
  Fedora 27: pdns Security Update (Feb 2)
 

- Update to 4.1.0 Release notes: https://doc.powerdns.com/authoritative/changelog/4.1.html Blog Announcement: https://blog.powerdns.com/2017/11/30/powerdns-authoritative-server-4-1
  Fedora 27: kernel Security Update (Feb 2)
 

The 4.14.16 stable kernel update contains a number of important fixes across the tree. ---- The 4.14.15-301 update reverts the retpoline VERMAGIC ABI change for modules. ---- The 4.14.15 stable kernel update contains a number of important fixes across the tree.
  Fedora 26: webkitgtk4 Security Update (Feb 2)
 

This update addresses the following vulnerabilities: * [CVE-2018-4088](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4088), [CVE-2017-13885](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13885), [CVE-2017-7165](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7165), [CVE-2017-13884](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13884),
  Fedora 26: kernel Security Update (Feb 2)
 

The 4.14.16 stable kernel update contains a number of important fixes across the tree. ---- The 4.14.15-301 update reverts the retpoline VERMAGIC ABI change for modules. ---- The 4.14.15 stable kernel update contains a number of important fixes across the tree.
  (Feb 9)
 

An update for kernel is now available for Red Hat Enterprise Linux 5 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
  (Feb 8)
 

An update is now available for Red Hat JBoss Core Services. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
  (Feb 7)
 

An update for flash-plugin is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
  (Feb 6)
 

An update for rh-mariadb100-mariadb is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
  (Feb 5)
 

An update for jboss-ec2-eap is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
  (Feb 5)
 

An update is now available for Red Hat Satellite 6.2 for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
  (Feb 5)
 

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 6 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
  (Feb 5)
 

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
  (Feb 5)
 

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
  (Feb 5)
 

An update is now available for Red Hat JBoss Enterprise Application Platform. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
  Slackware: 2018-037-01: Slackware 14.2 kernel Security Update (Feb 7)
 

New kernel packages are available for Slackware 14.2 to mitigate the speculative side channel attack known as Spectre variant 2.
  Slackware: 2018-034-01: php Security Update (Feb 4)
 

New php packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.
  SUSE: 2018:0416-1: important: the Linux Kernel (Feb 9)
 

An update that solves 9 vulnerabilities and has 44 fixes is now available.
  SUSE: 2018:0414-1: important: freetype2 (Feb 9)
 

An update that fixes four vulnerabilities is now available.
  openSUSE: 2018:0408-1: important: the Linux Kernel (Feb 9)
 

An update that solves 9 vulnerabilities and has 70 fixes is now available.
  openSUSE: 2018:0406-1: important: docker, docker-runc, containerd, golang-github-docker-libnetwork (Feb 9)
 

An update that solves two vulnerabilities and has 17 fixes is now available.
  openSUSE: 2018:0398-1: important: plasma5-workspace (Feb 8)
 

An update that solves two vulnerabilities and has one errata is now available.
  openSUSE: 2018:0397-1: important: plasma5-workspace (Feb 8)
 

An update that solves two vulnerabilities and has one errata is now available.
  SUSE: 2018:0386-1: important: Version docker, docker-runc, containerd, golang-github-docker-libnetwo (Feb 7)
 

An update that solves two vulnerabilities and has 17 fixes is now available.
  SUSE: 2018:0383-1: important: the Linux Kernel (Feb 7)
 

An update that solves 9 vulnerabilities and has 68 fixes is now available.
  SUSE: 2018:0374-1: important: MozillaFirefox (Feb 6)
 

An update that fixes 11 vulnerabilities is now available.
  SUSE: 2018:0362-1: important: bind (Feb 5)
 

An update that solves one vulnerability and has two fixes is now available.
  SUSE: 2018:0361-1: important: MozillaFirefox (Feb 5)
 

An update that fixes 11 vulnerabilities is now available.
  SUSE: 2018:0347-1: important: the Linux Kernel (Live Patch 3 for SLE 12 SP3) (Feb 2)
 

An update that fixes two vulnerabilities is now available.
  SUSE: 2018:0346-1: important: the Linux Kernel (Live Patch 1 for SLE 12 SP3) (Feb 2)
 

An update that fixes two vulnerabilities is now available.
  SUSE: 2018:0345-1: important: the Linux Kernel (Live Patch 4 for SLE 12 SP3) (Feb 2)
 

An update that fixes two vulnerabilities is now available.
  SUSE: 2018:0340-1: important: the Linux Kernel (Live Patch 2 for SLE 12 SP3) (Feb 2)
 

An update that fixes two vulnerabilities is now available.
  (Feb 9)
 

PostgreSQL could be made to expose sensitive information.
  (Feb 8)
 

Mailman could be made to run arbitrary code.
  (Feb 7)
 

Several security issues were fixed in Django.
  (Feb 5)
 

Several security issues were fixed in ClamAV.
  (Feb 9)
 

The package plasma-workspace before version 5.12.0-1 is vulnerable to arbitrary command execution.
  (Feb 9)
 

The package plasma-workspace before version 5.12.0-1 is vulnerable to arbitrary command execution.
  (Feb 9)
 

The package go-pie before version 1.9.4-1 is vulnerable to arbitrary code execution.
  (Feb 9)
 

The package go before version 1.9.4-1 is vulnerable to arbitrary code execution.
  (Feb 9)
 

The package clamav before version 0.99.3-1 is vulnerable to multiple issues including arbitrary code execution and denial of service.
  (Feb 9)
 

simplesamlphp, an authentication and federation application has been found vulnerable to Cross Site Scripting (XSS), signature validation byepass and using insecure connection charset.
  (Feb 9)
 

The mailman package has a Cross-site scripting (XSS) vulnerability in the web UI before 2.1.26 which allows remote attackers to inject arbitrary web script or HTML via a user-options URL
  (Feb 7)
 

A vulnerabilities has been found in the PostgreSQL database system: CVE-2018-1053
  (Feb 6)
 

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in privilege escalation. For Debian 7 "Wheezy", these problems have been fixed in version
  (Feb 4)
 

It was discovered that an XHR/AJAX call did not properly encode user input in the "dokuwiki" wiki platform. This resulted in a reflected file download vulnerability.
  (Feb 2)
 

The p7zip package has a heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip which allows remote attackers to cause a denial of service (out-of-bounds write) or potentially execute arbitrary code via a crafted ZIP archive.
  (Feb 2)
 

Squid, a high-performance proxy caching server for web clients, has been found vulnerable to denial of service attacks associated with ESI response processing and intermediate CA certificate downloading.
  (Feb 2)
 

Squid, a high-performance proxy caching server for web clients, has been found vulnerable to denial of service attacks associated with ESI response processing and intermediate CA certificate downloading.