January 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:0044-1: important: Security update for haproxy
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for haproxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0044-1 Rating: important References: #1119368 #1119419 Cross-References: CVE-2018-20102 CVE-2018-20103 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for haproxy to version 1.8.15 fixes the following issues: Security issues fixed: - CVE-2018-20102: Fixed an out-of-bounds read in dns_validate_dns_response(), which allowed for memory disclosure (bsc#1119368) - CVE-2018-20103: Fixed an infinite recursion via crafted packet allows stack exhaustion and denial of service (bsc#1119419) Other notable bug fixes: - Fix off-by-one write in dns_validate_dns_response() - Fix out-of-bounds read via signedness error in dns_validate_dns_response() - Prevent out-of-bounds read in dns_validate_dns_response() - Prevent out-of-bounds read in dns_read_name() - Prevent stack-exhaustion via recursion loop in dns_read_name For a full list of changes, please refer to: https://www.haproxy.org/download/1.8/src/CHANGELOG This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-44=1 Package List: - openSUSE Leap 15.0 (x86_64): haproxy-1.8.15~git0.6b6a350a-lp150.2.6.1 haproxy-debuginfo-1.8.15~git0.6b6a350a-lp150.2.6.1 haproxy-debugsource-1.8.15~git0.6b6a350a-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-20102.html https://www.suse.com/security/cve/CVE-2018-20103.html https://bugzilla.suse.com/1119368 https://bugzilla.suse.com/1119419 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0020-1: moderate: Security update for gpg2
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for gpg2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0020-1 Rating: moderate References: #1120346 Cross-References: CVE-2018-1000858 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gpg2 fixes the following issue: Security issue fixed: - CVE-2018-1000858: Fixed a Cross Site Request Forgery(CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF (bsc#1120346). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-20=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): gpg2-2.2.5-lp150.3.6.1 gpg2-debuginfo-2.2.5-lp150.3.6.1 gpg2-debugsource-2.2.5-lp150.3.6.1 - openSUSE Leap 15.0 (noarch): gpg2-lang-2.2.5-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-1000858.html https://bugzilla.suse.com/1120346 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0043-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0043-1 Rating: important References: #1112142 #1112143 #1112144 #1112146 #1112147 #1112148 #1112152 #1112153 Cross-References: CVE-2018-13785 CVE-2018-16435 CVE-2018-3136 CVE-2018-3139 CVE-2018-3149 CVE-2018-3169 CVE-2018-3180 CVE-2018-3183 CVE-2018-3214 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk to version 8u191 fixes the following issues: Security issues fixed: - CVE-2018-3136: Manifest better support (bsc#1112142) - CVE-2018-3139: Better HTTP Redirection (bsc#1112143) - CVE-2018-3149: Enhance JNDI lookups (bsc#1112144) - CVE-2018-3169: Improve field accesses (bsc#1112146) - CVE-2018-3180: Improve TLS connections stability (bsc#1112147) - CVE-2018-3214: Better RIFF reading support (bsc#1112152) - CVE-2018-13785: Upgrade JDK 8u to libpng 1.6.35 (bsc#1112153) - CVE-2018-3183: Improve script engine support (bsc#1112148) - CVE-2018-16435: heap-based buffer overflow in SetData function in cmsIT8LoadFromFile This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-43=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-43=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_8_0-openjdk-1.8.0.191-30.1 java-1_8_0-openjdk-accessibility-1.8.0.191-30.1 java-1_8_0-openjdk-debuginfo-1.8.0.191-30.1 java-1_8_0-openjdk-debugsource-1.8.0.191-30.1 java-1_8_0-openjdk-demo-1.8.0.191-30.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.191-30.1 java-1_8_0-openjdk-devel-1.8.0.191-30.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.191-30.1 java-1_8_0-openjdk-headless-1.8.0.191-30.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.191-30.1 java-1_8_0-openjdk-src-1.8.0.191-30.1 - openSUSE Leap 42.3 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.191-30.1 - openSUSE Leap 15.0 (i586 x86_64): java-1_8_0-openjdk-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-accessibility-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-debuginfo-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-debugsource-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-demo-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-demo-debuginfo-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-devel-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-devel-debuginfo-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-headless-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-headless-debuginfo-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-src-1.8.0.191-lp150.2.9.2 - openSUSE Leap 15.0 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.191-lp150.2.9.2 References: https://www.suse.com/security/cve/CVE-2018-13785.html https://www.suse.com/security/cve/CVE-2018-16435.html https://www.suse.com/security/cve/CVE-2018-3136.html https://www.suse.com/security/cve/CVE-2018-3139.html https://www.suse.com/security/cve/CVE-2018-3149.html https://www.suse.com/security/cve/CVE-2018-3169.html https://www.suse.com/security/cve/CVE-2018-3180.html https://www.suse.com/security/cve/CVE-2018-3183.html https://www.suse.com/security/cve/CVE-2018-3214.html https://bugzilla.suse.com/1112142 https://bugzilla.suse.com/1112143 https://bugzilla.suse.com/1112144 https://bugzilla.suse.com/1112146 https://bugzilla.suse.com/1112147 https://bugzilla.suse.com/1112148 https://bugzilla.suse.com/1112152 https://bugzilla.suse.com/1112153 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0019-1: moderate: Security update for discount
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for discount ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0019-1 Rating: moderate References: #1094809 #1098252 Cross-References: CVE-2018-11468 CVE-2018-12495 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for discount to version 2.2.4 fixes the following issues: Security issues fixed: - CVE-2018-11468: Fixed a heap-based buffer over-read in the __mkd_trim_line function from mkdio.c (boo#1094809) - CVE-2018-12495: Fixed a heap-based buffer over-read via a crafted file (boo#1098252) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-19=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-19=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-19=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): discount-2.2.4-7.3.1 discount-debugsource-2.2.4-7.3.1 libmarkdown-devel-2.2.4-7.3.1 libmarkdown2-2.2.4-7.3.1 libmarkdown2-debuginfo-2.2.4-7.3.1 - openSUSE Leap 15.0 (x86_64): discount-2.2.4-lp150.2.3.1 discount-debugsource-2.2.4-lp150.2.3.1 libmarkdown-devel-2.2.4-lp150.2.3.1 libmarkdown2-2.2.4-lp150.2.3.1 libmarkdown2-debuginfo-2.2.4-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): discount-2.2.4-bp150.3.3.1 libmarkdown-devel-2.2.4-bp150.3.3.1 libmarkdown2-2.2.4-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-11468.html https://www.suse.com/security/cve/CVE-2018-12495.html https://bugzilla.suse.com/1094809 https://bugzilla.suse.com/1098252 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0021-1: important: Security update for libgit2
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for libgit2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0021-1 Rating: important References: #1110949 #1114729 Cross-References: CVE-2018-19456 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for libgit2 fixes the following issues: Security issues fixed: - CVE-2018-19456: Fixed a code execution by malicious .gitmodules file (bsc#1110949) - various string-to-integer and buffer handling fixes (bsc#1114729). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-21=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libgit2-24-0.24.1-10.6.1 libgit2-24-debuginfo-0.24.1-10.6.1 libgit2-debugsource-0.24.1-10.6.1 libgit2-devel-0.24.1-10.6.1 - openSUSE Leap 42.3 (x86_64): libgit2-24-32bit-0.24.1-10.6.1 libgit2-24-debuginfo-32bit-0.24.1-10.6.1 References: https://www.suse.com/security/cve/CVE-2018-19456.html https://bugzilla.suse.com/1110949 https://bugzilla.suse.com/1114729 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0016-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 11 Jan '19

11 Jan '19

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0016-1 Rating: moderate References: #1120381 Cross-References: CVE-2018-20467 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issue: Security issue fixed: - CVE-2018-20467: Fixed infinite loop in coders/bmp.c (boo#1120381) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-16=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-123.1 GraphicsMagick-debuginfo-1.3.25-123.1 GraphicsMagick-debugsource-1.3.25-123.1 GraphicsMagick-devel-1.3.25-123.1 libGraphicsMagick++-Q16-12-1.3.25-123.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-123.1 libGraphicsMagick++-devel-1.3.25-123.1 libGraphicsMagick-Q16-3-1.3.25-123.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-123.1 libGraphicsMagick3-config-1.3.25-123.1 libGraphicsMagickWand-Q16-2-1.3.25-123.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-123.1 perl-GraphicsMagick-1.3.25-123.1 perl-GraphicsMagick-debuginfo-1.3.25-123.1 References: https://www.suse.com/security/cve/CVE-2018-20467.html https://bugzilla.suse.com/1120381 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0010-1: moderate: Security update for polkit
by opensuse-security＠opensuse.org 10 Jan '19

10 Jan '19

openSUSE Security Update: Security update for polkit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0010-1 Rating: moderate References: #1118277 Cross-References: CVE-2018-19788 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for polkit fixes the following issues: Security issue fixed: - CVE-2018-19788: Fixed handling of UIDs over MAX_UINT (bsc#1118277) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-10=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libpolkit0-0.114-lp150.2.6.1 libpolkit0-debuginfo-0.114-lp150.2.6.1 polkit-0.114-lp150.2.6.1 polkit-debuginfo-0.114-lp150.2.6.1 polkit-debugsource-0.114-lp150.2.6.1 polkit-devel-0.114-lp150.2.6.1 polkit-devel-debuginfo-0.114-lp150.2.6.1 typelib-1_0-Polkit-1_0-0.114-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libpolkit0-32bit-0.114-lp150.2.6.1 libpolkit0-32bit-debuginfo-0.114-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): polkit-doc-0.114-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-19788.html https://bugzilla.suse.com/1118277 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0008-1: moderate: Security update for libraw
by opensuse-security＠opensuse.org 10 Jan '19

10 Jan '19

openSUSE Security Update: Security update for libraw ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0008-1 Rating: moderate References: #1097975 #1103200 #1103206 Cross-References: CVE-2018-5804 CVE-2018-5813 CVE-2018-5815 CVE-2018-5816 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libraw fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-5813: Fixed an error within the "parse_minolta()" function (dcraw/dcraw.c) that could be exploited to trigger an infinite loop via a specially crafted file. This could be exploited to cause a DoS.(boo#1103200). - CVE-2018-5815: Fixed an integer overflow in the internal/dcraw_common.cpp:parse_qt() function, that could be exploited to cause an infinite loop via a specially crafted Apple QuickTime file. (boo#1103206) - CVE-2018-5804,CVE-2018-5816: Fixed a type confusion error in the identify function (bsc#1097975) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-8=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libraw-debuginfo-0.18.9-lp150.2.3.1 libraw-debugsource-0.18.9-lp150.2.3.1 libraw-devel-0.18.9-lp150.2.3.1 libraw-devel-static-0.18.9-lp150.2.3.1 libraw-tools-0.18.9-lp150.2.3.1 libraw-tools-debuginfo-0.18.9-lp150.2.3.1 libraw16-0.18.9-lp150.2.3.1 libraw16-debuginfo-0.18.9-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-5804.html https://www.suse.com/security/cve/CVE-2018-5813.html https://www.suse.com/security/cve/CVE-2018-5815.html https://www.suse.com/security/cve/CVE-2018-5816.html https://bugzilla.suse.com/1097975 https://bugzilla.suse.com/1103200 https://bugzilla.suse.com/1103206 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0009-1: important: Security update for singularity
by opensuse-security＠opensuse.org 10 Jan '19

10 Jan '19

openSUSE Security Update: Security update for singularity ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0009-1 Rating: important References: #1111411 Cross-References: CVE-2018-19295 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for singularity to version 2.6.1 fixes the following issues: Security issues fixed: - CVE-2018-19295: Fixed a local root exploit, related to joining arbitrary mount namespaces (boo#1111411). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-9=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-9=1 Package List: - openSUSE Leap 15.0 (x86_64): libsingularity1-2.6.1-lp150.2.6.1 libsingularity1-debuginfo-2.6.1-lp150.2.6.1 singularity-2.6.1-lp150.2.6.1 singularity-debuginfo-2.6.1-lp150.2.6.1 singularity-debugsource-2.6.1-lp150.2.6.1 singularity-devel-2.6.1-lp150.2.6.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libsingularity1-2.6.1-bp150.3.6.1 singularity-2.6.1-bp150.3.6.1 singularity-devel-2.6.1-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-19295.html https://bugzilla.suse.com/1111411 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0003-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 01 Jan '19

01 Jan '19

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0003-1 Rating: moderate References: #1119790 #1119822 Cross-References: CVE-2018-20184 CVE-2018-20189 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: Security vulnerabilities fixed: - CVE-2018-20184: Fixed heap-based buffer overflow in the WriteTGAImage function of tga.c (bsc#1119822) - CVE-2018-20189: Fixed denial of service vulnerability in ReadDIBImage function of coders/dib.c (bsc#1119790) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-3=1 Package List: - openSUSE Backports SLE-15 (x86_64): GraphicsMagick-1.3.29-bp150.2.12.1 GraphicsMagick-devel-1.3.29-bp150.2.12.1 libGraphicsMagick++-Q16-12-1.3.29-bp150.2.12.1 libGraphicsMagick++-devel-1.3.29-bp150.2.12.1 libGraphicsMagick-Q16-3-1.3.29-bp150.2.12.1 libGraphicsMagick3-config-1.3.29-bp150.2.12.1 libGraphicsMagickWand-Q16-2-1.3.29-bp150.2.12.1 perl-GraphicsMagick-1.3.29-bp150.2.12.1 References: https://www.suse.com/security/cve/CVE-2018-20184.html https://www.suse.com/security/cve/CVE-2018-20189.html https://bugzilla.suse.com/1119790 https://bugzilla.suse.com/1119822 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0