April 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:1282-1: important: Security update for python3
by opensuse-security＠opensuse.org 26 Apr '19

26 Apr '19

openSUSE Security Update: Security update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1282-1 Rating: important References: #1129346 Cross-References: CVE-2019-9636 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python3 fixes the following issues: Security issue fixed: - CVE-2019-9636: Fixed an information disclosure because of incorrect handling of Unicode encoding during NFKC normalization (bsc#1129346). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1282=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): python3-3.6.5-lp150.2.10.1 python3-curses-3.6.5-lp150.2.10.1 python3-curses-debuginfo-3.6.5-lp150.2.10.1 python3-dbm-3.6.5-lp150.2.10.1 python3-dbm-debuginfo-3.6.5-lp150.2.10.1 python3-debuginfo-3.6.5-lp150.2.10.1 python3-debugsource-3.6.5-lp150.2.10.1 python3-tk-3.6.5-lp150.2.10.1 python3-tk-debuginfo-3.6.5-lp150.2.10.1 - openSUSE Leap 15.0 (x86_64): python3-32bit-3.6.5-lp150.2.10.1 python3-32bit-debuginfo-3.6.5-lp150.2.10.1 References: https://www.suse.com/security/cve/CVE-2019-9636.html https://bugzilla.suse.com/1129346 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1277-1: moderate: Security update for kauth
by opensuse-security＠opensuse.org 26 Apr '19

26 Apr '19

openSUSE Security Update: Security update for kauth ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1277-1 Rating: moderate References: #1124863 Cross-References: CVE-2019-7443 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kauth fixes the following issues: Security issue fixed: - CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants (bsc#1124863). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1277=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): kauth-debugsource-5.45.0-bp150.8.2 kauth-devel-5.45.0-bp150.8.2 libKF5Auth5-5.45.0-bp150.8.2 libKF5Auth5-debuginfo-5.45.0-bp150.8.2 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x): libpolkit-qt5-1-1-0.112.0-bp150.3.6.1 libpolkit-qt5-1-devel-0.112.0-bp150.3.6.1 - openSUSE Backports SLE-15 (aarch64_ilp32): kauth-devel-64bit-5.45.0-bp150.8.2 libKF5Auth5-64bit-5.45.0-bp150.8.2 libKF5Auth5-64bit-debuginfo-5.45.0-bp150.8.2 libpolkit-qt5-1-1-64bit-0.112.0-bp150.3.6.1 libpolkit-qt5-1-devel-64bit-0.112.0-bp150.3.6.1 - openSUSE Backports SLE-15 (noarch): libKF5Auth5-lang-5.45.0-bp150.8.2 - openSUSE Backports SLE-15 (x86_64): libpolkit-qt5-1-1-0.112.0-bp150.3.6.2 libpolkit-qt5-1-devel-0.112.0-bp150.3.6.2 References: https://www.suse.com/security/cve/CVE-2019-7443.html https://bugzilla.suse.com/1124863 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1276-1: moderate: Security update for xmltooling
by opensuse-security＠opensuse.org 25 Apr '19

25 Apr '19

openSUSE Security Update: Security update for xmltooling ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1276-1 Rating: moderate References: #1129537 Cross-References: CVE-2019-9628 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xmltooling fixes the following issue: Security issue fixed: - CVE-2019-9628: Fixed an improper handling of exception in XMLTooling library which could result in denial of service against the application using XMLTooling (bsc#1129537). This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1276=1 Package List: - openSUSE Leap 42.3 (x86_64): libxmltooling-devel-1.5.6-12.1 libxmltooling6-1.5.6-12.1 libxmltooling6-debuginfo-1.5.6-12.1 xmltooling-debugsource-1.5.6-12.1 xmltooling-schemas-1.5.6-12.1 References: https://www.suse.com/security/cve/CVE-2019-9628.html https://bugzilla.suse.com/1129537 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1274-1: important: Security update for qemu
by opensuse-security＠opensuse.org 25 Apr '19

25 Apr '19

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1274-1 Rating: important References: #1118900 #1125721 #1126455 #1129622 #1130675 #1131955 Cross-References: CVE-2018-20815 CVE-2019-3812 CVE-2019-8934 CVE-2019-9824 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves four vulnerabilities and has two fixes is now available. Description: This update for qemu fixes the following issues: Security issues fixed: - CVE-2019-9824: Fixed information leak in slirp (bsc#1129622). - CVE-2019-8934: Added method to specify whether or not to expose certain ppc64 hostinformation (bsc#1126455). - CVE-2019-3812: Fixed Out-of-bounds memory access and information leak in virtual monitor interface (bsc#1125721). - CVE-2018-20815: Fixed a denial of service possibility in device tree processing (bsc#1130675). Non-security issue fixed: - Backported Skylake-Server vcpu model support from qemu v2.11 (FATE#327261 bsc#1131955). - Added ability to set virtqueue size using virtqueue_size parameter (FATE#327255 bsc#1118900). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1274=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): qemu-linux-user-2.9.1-59.1 qemu-linux-user-debuginfo-2.9.1-59.1 qemu-linux-user-debugsource-2.9.1-59.1 - openSUSE Leap 42.3 (noarch): qemu-ipxe-1.0.0+-59.1 qemu-seabios-1.10.2-59.1 qemu-sgabios-8-59.1 qemu-vgabios-1.10.2-59.1 - openSUSE Leap 42.3 (x86_64): qemu-2.9.1-59.1 qemu-arm-2.9.1-59.1 qemu-arm-debuginfo-2.9.1-59.1 qemu-block-curl-2.9.1-59.1 qemu-block-curl-debuginfo-2.9.1-59.1 qemu-block-dmg-2.9.1-59.1 qemu-block-dmg-debuginfo-2.9.1-59.1 qemu-block-iscsi-2.9.1-59.1 qemu-block-iscsi-debuginfo-2.9.1-59.1 qemu-block-rbd-2.9.1-59.1 qemu-block-rbd-debuginfo-2.9.1-59.1 qemu-block-ssh-2.9.1-59.1 qemu-block-ssh-debuginfo-2.9.1-59.1 qemu-debugsource-2.9.1-59.1 qemu-extra-2.9.1-59.1 qemu-extra-debuginfo-2.9.1-59.1 qemu-guest-agent-2.9.1-59.1 qemu-guest-agent-debuginfo-2.9.1-59.1 qemu-ksm-2.9.1-59.1 qemu-kvm-2.9.1-59.1 qemu-lang-2.9.1-59.1 qemu-ppc-2.9.1-59.1 qemu-ppc-debuginfo-2.9.1-59.1 qemu-s390-2.9.1-59.1 qemu-s390-debuginfo-2.9.1-59.1 qemu-testsuite-2.9.1-59.2 qemu-tools-2.9.1-59.1 qemu-tools-debuginfo-2.9.1-59.1 qemu-x86-2.9.1-59.1 qemu-x86-debuginfo-2.9.1-59.1 References: https://www.suse.com/security/cve/CVE-2018-20815.html https://www.suse.com/security/cve/CVE-2019-3812.html https://www.suse.com/security/cve/CVE-2019-8934.html https://www.suse.com/security/cve/CVE-2019-9824.html https://bugzilla.suse.com/1118900 https://bugzilla.suse.com/1125721 https://bugzilla.suse.com/1126455 https://bugzilla.suse.com/1129622 https://bugzilla.suse.com/1130675 https://bugzilla.suse.com/1131955 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1272-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 25 Apr '19

25 Apr '19

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1272-1 Rating: moderate References: #1132053 #1132054 #1132055 #1132058 #1132060 #1132061 Cross-References: CVE-2019-11005 CVE-2019-11006 CVE-2019-11007 CVE-2019-11008 CVE-2019-11009 CVE-2019-11010 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: - CVE-2019-11005: Fixed a stack-based buffer overflow in SVGStartElement of coders/svg.c that allowed attackers to cause DOS or an unspecified impact (boo#1132058) - CVE-2019-11006: Fixed a heap-based buffer over-read in the function ReadMIFFImage of coders/miff.c that allowed attackers to cause DOS or information disclosure (boo#1132061) - CVE-2019-11010: Fixed a memory leak in ReadMPCImage of coders/mpc.c that which allowed attackers to cause DOS via a crafted image file (boo#1132055) - CVE-2019-11007: Fixed a heap-based buffer over-read in the ReadMNGImage function of coders/png.c that which allowed attackers to cause a denial of service or information disclosure (boo#1132060) - CVE-2019-11008: Fixed a heap-based buffer overflow in the function WriteXWDImage of coders/xwd.c that which allowed remote attackers to cause DOS or other unspecified impact (boo#1132054) - CVE-2019-11009: Fixed a heap-based buffer over-read in the function ReadXWDImage of coders/xwd.c that which allowed attackers to cause DOS or information disclosure (boo#1132053) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1272=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1272=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-132.1 GraphicsMagick-debuginfo-1.3.25-132.1 GraphicsMagick-debugsource-1.3.25-132.1 GraphicsMagick-devel-1.3.25-132.1 libGraphicsMagick++-Q16-12-1.3.25-132.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-132.1 libGraphicsMagick++-devel-1.3.25-132.1 libGraphicsMagick-Q16-3-1.3.25-132.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-132.1 libGraphicsMagick3-config-1.3.25-132.1 libGraphicsMagickWand-Q16-2-1.3.25-132.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-132.1 perl-GraphicsMagick-1.3.25-132.1 perl-GraphicsMagick-debuginfo-1.3.25-132.1 - openSUSE Leap 15.0 (x86_64): GraphicsMagick-1.3.29-lp150.3.25.1 GraphicsMagick-debuginfo-1.3.29-lp150.3.25.1 GraphicsMagick-debugsource-1.3.29-lp150.3.25.1 GraphicsMagick-devel-1.3.29-lp150.3.25.1 libGraphicsMagick++-Q16-12-1.3.29-lp150.3.25.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.29-lp150.3.25.1 libGraphicsMagick++-devel-1.3.29-lp150.3.25.1 libGraphicsMagick-Q16-3-1.3.29-lp150.3.25.1 libGraphicsMagick-Q16-3-debuginfo-1.3.29-lp150.3.25.1 libGraphicsMagick3-config-1.3.29-lp150.3.25.1 libGraphicsMagickWand-Q16-2-1.3.29-lp150.3.25.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.29-lp150.3.25.1 perl-GraphicsMagick-1.3.29-lp150.3.25.1 perl-GraphicsMagick-debuginfo-1.3.29-lp150.3.25.1 References: https://www.suse.com/security/cve/CVE-2019-11005.html https://www.suse.com/security/cve/CVE-2019-11006.html https://www.suse.com/security/cve/CVE-2019-11007.html https://www.suse.com/security/cve/CVE-2019-11008.html https://www.suse.com/security/cve/CVE-2019-11009.html https://www.suse.com/security/cve/CVE-2019-11010.html https://bugzilla.suse.com/1132053 https://bugzilla.suse.com/1132054 https://bugzilla.suse.com/1132055 https://bugzilla.suse.com/1132058 https://bugzilla.suse.com/1132060 https://bugzilla.suse.com/1132061 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1273-1: important: Security update for python
by opensuse-security＠opensuse.org 25 Apr '19

25 Apr '19

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1273-1 Rating: important References: #1129346 #1130847 Cross-References: CVE-2019-9636 CVE-2019-9948 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python fixes the following issues: Security issues fixed: - CVE-2019-9948: Fixed a 'file:' blacklist bypass in URIs by using the 'local-file:' scheme instead (bsc#1130847). - CVE-2019-9636: Fixed an information disclosure because of incorrect handling of Unicode encoding during NFKC normalization (bsc#1129346). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1273=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): python-2.7.14-lp150.6.10.1 python-curses-2.7.14-lp150.6.10.1 python-curses-debuginfo-2.7.14-lp150.6.10.1 python-debuginfo-2.7.14-lp150.6.10.1 python-debugsource-2.7.14-lp150.6.10.1 python-demo-2.7.14-lp150.6.10.1 python-gdbm-2.7.14-lp150.6.10.1 python-gdbm-debuginfo-2.7.14-lp150.6.10.1 python-idle-2.7.14-lp150.6.10.1 python-tk-2.7.14-lp150.6.10.1 python-tk-debuginfo-2.7.14-lp150.6.10.1 - openSUSE Leap 15.0 (x86_64): python-32bit-2.7.14-lp150.6.10.1 python-32bit-debuginfo-2.7.14-lp150.6.10.1 References: https://www.suse.com/security/cve/CVE-2019-9636.html https://www.suse.com/security/cve/CVE-2019-9948.html https://bugzilla.suse.com/1129346 https://bugzilla.suse.com/1130847 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1275-1: important: Security update for lxc, lxcfs
by opensuse-security＠opensuse.org 25 Apr '19

25 Apr '19

openSUSE Security Update: Security update for lxc, lxcfs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1275-1 Rating: important References: #1122185 #1131762 #988348 Cross-References: CVE-2018-6556 CVE-2019-5736 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for lxc, lxcfs to version 3.1.0 fixes the following issues: Security issues fixed: - CVE-2019-5736: Fixed a container breakout vulnerability (boo#1122185). - CVE-2018-6556: Enable setuid bit on lxc-user-nic (boo#988348). Non-security issues fixed: - Update to LXC 3.1.0. The changelog is far too long to include here, please look at https://linuxcontainers.org/. (boo#1131762) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1275=1 Package List: - openSUSE Leap 15.0 (x86_64): liblxc-devel-3.1.0-lp150.2.10.1 liblxc1-3.1.0-lp150.2.10.1 liblxc1-debuginfo-3.1.0-lp150.2.10.1 lxc-3.1.0-lp150.2.10.1 lxc-debuginfo-3.1.0-lp150.2.10.1 lxc-debugsource-3.1.0-lp150.2.10.1 lxcfs-3.0.3-lp150.2.3.1 lxcfs-debuginfo-3.0.3-lp150.2.3.1 lxcfs-debugsource-3.0.3-lp150.2.3.1 pam_cgfs-3.1.0-lp150.2.10.1 pam_cgfs-debuginfo-3.1.0-lp150.2.10.1 - openSUSE Leap 15.0 (noarch): lxc-bash-completion-3.1.0-lp150.2.10.1 lxcfs-hooks-lxc-3.0.3-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-6556.html https://www.suse.com/security/cve/CVE-2019-5736.html https://bugzilla.suse.com/1122185 https://bugzilla.suse.com/1131762 https://bugzilla.suse.com/988348 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1264-1: moderate: Security update for slurm
by opensuse-security＠opensuse.org 24 Apr '19

24 Apr '19

openSUSE Security Update: Security update for slurm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1264-1 Rating: moderate References: #1123304 Cross-References: CVE-2019-6438 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for slurm to version 17.11.13 fixes the following issues: Security issue fixed: - CVE-2019-6438: Fixed a heap overflow on 32-bit systems in xmalloc (bsc#1123304). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1264=1 Package List: - openSUSE Leap 15.0 (x86_64): libpmi0-17.11.13-lp150.5.20.1 libpmi0-debuginfo-17.11.13-lp150.5.20.1 libslurm32-17.11.13-lp150.5.20.1 libslurm32-debuginfo-17.11.13-lp150.5.20.1 perl-slurm-17.11.13-lp150.5.20.1 perl-slurm-debuginfo-17.11.13-lp150.5.20.1 slurm-17.11.13-lp150.5.20.1 slurm-auth-none-17.11.13-lp150.5.20.1 slurm-auth-none-debuginfo-17.11.13-lp150.5.20.1 slurm-config-17.11.13-lp150.5.20.1 slurm-debuginfo-17.11.13-lp150.5.20.1 slurm-debugsource-17.11.13-lp150.5.20.1 slurm-devel-17.11.13-lp150.5.20.1 slurm-doc-17.11.13-lp150.5.20.1 slurm-lua-17.11.13-lp150.5.20.1 slurm-lua-debuginfo-17.11.13-lp150.5.20.1 slurm-munge-17.11.13-lp150.5.20.1 slurm-munge-debuginfo-17.11.13-lp150.5.20.1 slurm-node-17.11.13-lp150.5.20.1 slurm-node-debuginfo-17.11.13-lp150.5.20.1 slurm-openlava-17.11.13-lp150.5.20.1 slurm-pam_slurm-17.11.13-lp150.5.20.1 slurm-pam_slurm-debuginfo-17.11.13-lp150.5.20.1 slurm-plugins-17.11.13-lp150.5.20.1 slurm-plugins-debuginfo-17.11.13-lp150.5.20.1 slurm-seff-17.11.13-lp150.5.20.1 slurm-sjstat-17.11.13-lp150.5.20.1 slurm-slurmdbd-17.11.13-lp150.5.20.1 slurm-slurmdbd-debuginfo-17.11.13-lp150.5.20.1 slurm-sql-17.11.13-lp150.5.20.1 slurm-sql-debuginfo-17.11.13-lp150.5.20.1 slurm-sview-17.11.13-lp150.5.20.1 slurm-sview-debuginfo-17.11.13-lp150.5.20.1 slurm-torque-17.11.13-lp150.5.20.1 slurm-torque-debuginfo-17.11.13-lp150.5.20.1 References: https://www.suse.com/security/cve/CVE-2019-6438.html https://bugzilla.suse.com/1123304 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1265-1: Security update for openexr
by opensuse-security＠opensuse.org 24 Apr '19

24 Apr '19

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1265-1 Rating: low References: #1113455 Cross-References: CVE-2018-18444 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openexr fixes the following issues: Security issue fixed: - CVE-2018-18444: Fixed Out-of-bounds write in makeMultiView.cpp (bsc#1113455). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1265=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libIlmImf-2_2-23-2.2.1-lp150.2.3.1 libIlmImf-2_2-23-debuginfo-2.2.1-lp150.2.3.1 libIlmImfUtil-2_2-23-2.2.1-lp150.2.3.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-lp150.2.3.1 openexr-2.2.1-lp150.2.3.1 openexr-debuginfo-2.2.1-lp150.2.3.1 openexr-debugsource-2.2.1-lp150.2.3.1 openexr-devel-2.2.1-lp150.2.3.1 openexr-doc-2.2.1-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-lp150.2.3.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-lp150.2.3.1 libIlmImfUtil-2_2-23-32bit-2.2.1-lp150.2.3.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-18444.html https://bugzilla.suse.com/1113455 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1261-1: moderate: Security update for SDL2
by opensuse-security＠opensuse.org 23 Apr '19

23 Apr '19

openSUSE Security Update: Security update for SDL2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1261-1 Rating: moderate References: #1124799 #1124800 #1124802 #1124803 #1124805 #1124806 #1124824 #1124825 #1124826 #1124827 #1125099 Cross-References: CVE-2019-7572 CVE-2019-7573 CVE-2019-7574 CVE-2019-7575 CVE-2019-7576 CVE-2019-7577 CVE-2019-7578 CVE-2019-7635 CVE-2019-7636 CVE-2019-7637 CVE-2019-7638 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for SDL2 fixes the following issues: Security issues fixed: - CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806). - CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099). - CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799). - CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805). - CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827). - CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826). - CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824). - CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803). - CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802). - CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825). - CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1261=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): SDL2-debugsource-2.0.8-lp150.2.3.1 libSDL2-2_0-0-2.0.8-lp150.2.3.1 libSDL2-2_0-0-debuginfo-2.0.8-lp150.2.3.1 libSDL2-devel-2.0.8-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libSDL2-2_0-0-32bit-2.0.8-lp150.2.3.1 libSDL2-2_0-0-32bit-debuginfo-2.0.8-lp150.2.3.1 libSDL2-devel-32bit-2.0.8-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-7572.html https://www.suse.com/security/cve/CVE-2019-7573.html https://www.suse.com/security/cve/CVE-2019-7574.html https://www.suse.com/security/cve/CVE-2019-7575.html https://www.suse.com/security/cve/CVE-2019-7576.html https://www.suse.com/security/cve/CVE-2019-7577.html https://www.suse.com/security/cve/CVE-2019-7578.html https://www.suse.com/security/cve/CVE-2019-7635.html https://www.suse.com/security/cve/CVE-2019-7636.html https://www.suse.com/security/cve/CVE-2019-7637.html https://www.suse.com/security/cve/CVE-2019-7638.html https://bugzilla.suse.com/1124799 https://bugzilla.suse.com/1124800 https://bugzilla.suse.com/1124802 https://bugzilla.suse.com/1124803 https://bugzilla.suse.com/1124805 https://bugzilla.suse.com/1124806 https://bugzilla.suse.com/1124824 https://bugzilla.suse.com/1124825 https://bugzilla.suse.com/1124826 https://bugzilla.suse.com/1124827 https://bugzilla.suse.com/1125099 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0