May 2019 - openSUSE Security Announce - openSUSE Mailing Lists

[security-announce] openSUSE-SU-2019:1345-1: moderate: Security update for wpa_supplicant
by opensuse-security＠opensuse.org 08 May '19

08 May '19

openSUSE Security Update: Security update for wpa_supplicant ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1345-1 Rating: moderate References: #1104205 #1109209 Cross-References: CVE-2018-14526 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for wpa_supplicant fixes the following issues: This security issue was fixed: - CVE-2018-14526: Under certain conditions, the integrity of EAPOL-Key messages was not checked, leading to a decryption oracle. An attacker within range of the Access Point and client could have abused the vulnerability to recover sensitive information (bsc#1104205). This non-security issue was fixed: - Enabled PWD as EAP method. This allows for password-based authentication, which is easier to setup than most of the other methods, and is used by the Eduroam network (bsc#1109209). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1345=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): wpa_supplicant-2.6-16.1 wpa_supplicant-debuginfo-2.6-16.1 wpa_supplicant-debugsource-2.6-16.1 wpa_supplicant-gui-2.6-16.1 wpa_supplicant-gui-debuginfo-2.6-16.1 References: https://www.suse.com/security/cve/CVE-2018-14526.html https://bugzilla.suse.com/1104205 https://bugzilla.suse.com/1109209 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1342-1: important: Security update for pacemaker
by opensuse-security＠opensuse.org 08 May '19

08 May '19

openSUSE Security Update: Security update for pacemaker ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1342-1 Rating: important References: #1131353 #1131356 Cross-References: CVE-2018-16877 CVE-2018-16878 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for pacemaker fixes the following issues: Security issues fixed: - CVE-2018-16877: Fixed a local privilege escalation through insufficient IPC client-server authentication. (bsc#1131356) - CVE-2018-16878: Fixed a denial of service through insufficient verification inflicted preference of uncontrolled processes. (bsc#1131353) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1342=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libpacemaker-devel-1.1.16-4.12.1 libpacemaker3-1.1.16-4.12.1 libpacemaker3-debuginfo-1.1.16-4.12.1 pacemaker-1.1.16-4.12.1 pacemaker-cli-1.1.16-4.12.1 pacemaker-cli-debuginfo-1.1.16-4.12.1 pacemaker-cts-1.1.16-4.12.1 pacemaker-cts-debuginfo-1.1.16-4.12.1 pacemaker-debuginfo-1.1.16-4.12.1 pacemaker-debugsource-1.1.16-4.12.1 pacemaker-remote-1.1.16-4.12.1 pacemaker-remote-debuginfo-1.1.16-4.12.1 References: https://www.suse.com/security/cve/CVE-2018-16877.html https://www.suse.com/security/cve/CVE-2018-16878.html https://bugzilla.suse.com/1131353 https://bugzilla.suse.com/1131356 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1344-1: moderate: Security update for rubygem-actionpack-5_1
by opensuse-security＠opensuse.org 08 May '19

08 May '19

openSUSE Security Update: Security update for rubygem-actionpack-5_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1344-1 Rating: moderate References: #1129271 #1129272 Cross-References: CVE-2019-5418 CVE-2019-5419 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for rubygem-actionpack-5_1 fixes the following issues: Security issues fixed: - CVE-2019-5418: Fixed a file content disclosure vulnerability in Action View which could be exploited via specially crafted accept headers in combination with calls to render file (bsc#1129272). - CVE-2019-5419: Fixed a resource exhaustion issue in Action View which could make the server unable to process requests (bsc#1129271). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1344=1 Package List: - openSUSE Leap 15.0 (x86_64): ruby2.5-rubygem-actionpack-5_1-5.1.4-lp150.2.3.1 ruby2.5-rubygem-actionpack-doc-5_1-5.1.4-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-5418.html https://www.suse.com/security/cve/CVE-2019-5419.html https://bugzilla.suse.com/1129271 https://bugzilla.suse.com/1129272 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1331-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 04 May '19

04 May '19

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1331-1 Rating: moderate References: #1122033 #1130330 #1131317 #1132054 #1132060 Cross-References: CVE-2019-10650 CVE-2019-11007 CVE-2019-11008 CVE-2019-9956 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2019-9956: Fixed a stack-based buffer overflow in PopHexPixel() (bsc#1130330). - CVE-2019-10650: Fixed a heap-based buffer over-read in WriteTIFFImage() (bsc#1131317). - CVE-2019-11007: Fixed a heap-based buffer overflow in ReadMNGImage() (bsc#1132060). - CVE-2019-11008: Fixed a heap-based buffer overflow in WriteXWDImage() (bsc#1132054). - Added extra -config- packages with Postscript/EPS/PDF readers still enabled. Removing the PS decoders is used to harden ImageMagick against security issues within ghostscript. Enabling them might impact security. (bsc#1122033) These are two packages that can be selected: - ImageMagick-config-7-SUSE: This has the PS decoders disabled. - ImageMagick-config-7-upstream: This has the PS decoders enabled. Depending on your local needs install either one of them. The default is the -SUSE configuration. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1331=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ImageMagick-7.0.7.34-lp150.2.29.1 ImageMagick-config-7-SUSE-7.0.7.34-lp150.2.29.1 ImageMagick-config-7-upstream-7.0.7.34-lp150.2.29.1 ImageMagick-debuginfo-7.0.7.34-lp150.2.29.1 ImageMagick-debugsource-7.0.7.34-lp150.2.29.1 ImageMagick-devel-7.0.7.34-lp150.2.29.1 ImageMagick-extra-7.0.7.34-lp150.2.29.1 ImageMagick-extra-debuginfo-7.0.7.34-lp150.2.29.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp150.2.29.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp150.2.29.1 libMagick++-devel-7.0.7.34-lp150.2.29.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp150.2.29.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.29.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp150.2.29.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.29.1 perl-PerlMagick-7.0.7.34-lp150.2.29.1 perl-PerlMagick-debuginfo-7.0.7.34-lp150.2.29.1 - openSUSE Leap 15.0 (noarch): ImageMagick-doc-7.0.7.34-lp150.2.29.1 - openSUSE Leap 15.0 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp150.2.29.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp150.2.29.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp150.2.29.1 libMagick++-devel-32bit-7.0.7.34-lp150.2.29.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.29.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.29.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.29.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.29.1 References: https://www.suse.com/security/cve/CVE-2019-10650.html https://www.suse.com/security/cve/CVE-2019-11007.html https://www.suse.com/security/cve/CVE-2019-11008.html https://www.suse.com/security/cve/CVE-2019-9956.html https://bugzilla.suse.com/1122033 https://bugzilla.suse.com/1130330 https://bugzilla.suse.com/1131317 https://bugzilla.suse.com/1132054 https://bugzilla.suse.com/1132060 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1325-1: important: Security update for chromium
by opensuse-security＠opensuse.org 04 May '19

04 May '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1325-1 Rating: important References: #1133313 Cross-References: CVE-2019-5805 CVE-2019-5806 CVE-2019-5807 CVE-2019-5808 CVE-2019-5809 CVE-2019-5810 CVE-2019-5811 CVE-2019-5812 CVE-2019-5813 CVE-2019-5814 CVE-2019-5815 CVE-2019-5816 CVE-2019-5817 CVE-2019-5818 CVE-2019-5819 CVE-2019-5820 CVE-2019-5821 CVE-2019-5822 CVE-2019-5823 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 19 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to 74.0.3729.108 boo#1133313: * CVE-2019-5805: Use after free in PDFium * CVE-2019-5806: Integer overflow in Angle * CVE-2019-5807: Memory corruption in V8 * CVE-2019-5808: Use after free in Blink * CVE-2019-5809: Use after free in Blink * CVE-2019-5810: User information disclosure in Autofill * CVE-2019-5811: CORS bypass in Blink * CVE-2019-5813: Out of bounds read in V8 * CVE-2019-5814: CORS bypass in Blink * CVE-2019-5815: Heap buffer overflow in Blink * CVE-2019-5818: Uninitialized value in media reader * CVE-2019-5819: Incorrect escaping in developer tools * CVE-2019-5820: Integer overflow in PDFium * CVE-2019-5821: Integer overflow in PDFium * CVE-2019-5822: CORS bypass in download manager * CVE-2019-5823: Forced navigation from service worker * CVE-2019-5812: URL spoof in Omnibox on iOS * CVE-2019-5816: Exploit persistence extension on Android * CVE-2019-5817: Heap buffer overflow in Angle on Windows - Update conditions to use system harfbuzz on TW+ - Require java during build - Enable using pipewire when available Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1325=1 Package List: - openSUSE Leap 15.0 (x86_64): chromedriver-74.0.3729.108-lp150.209.2 chromedriver-debuginfo-74.0.3729.108-lp150.209.2 chromium-74.0.3729.108-lp150.209.2 chromium-debuginfo-74.0.3729.108-lp150.209.2 chromium-debugsource-74.0.3729.108-lp150.209.2 References: https://www.suse.com/security/cve/CVE-2019-5805.html https://www.suse.com/security/cve/CVE-2019-5806.html https://www.suse.com/security/cve/CVE-2019-5807.html https://www.suse.com/security/cve/CVE-2019-5808.html https://www.suse.com/security/cve/CVE-2019-5809.html https://www.suse.com/security/cve/CVE-2019-5810.html https://www.suse.com/security/cve/CVE-2019-5811.html https://www.suse.com/security/cve/CVE-2019-5812.html https://www.suse.com/security/cve/CVE-2019-5813.html https://www.suse.com/security/cve/CVE-2019-5814.html https://www.suse.com/security/cve/CVE-2019-5815.html https://www.suse.com/security/cve/CVE-2019-5816.html https://www.suse.com/security/cve/CVE-2019-5817.html https://www.suse.com/security/cve/CVE-2019-5818.html https://www.suse.com/security/cve/CVE-2019-5819.html https://www.suse.com/security/cve/CVE-2019-5820.html https://www.suse.com/security/cve/CVE-2019-5821.html https://www.suse.com/security/cve/CVE-2019-5822.html https://www.suse.com/security/cve/CVE-2019-5823.html https://bugzilla.suse.com/1133313 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1324-1: important: Security update for chromium
by opensuse-security＠opensuse.org 04 May '19

04 May '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1324-1 Rating: important References: #1133313 Cross-References: CVE-2019-5805 CVE-2019-5806 CVE-2019-5807 CVE-2019-5808 CVE-2019-5809 CVE-2019-5810 CVE-2019-5811 CVE-2019-5813 CVE-2019-5814 CVE-2019-5815 CVE-2019-5818 CVE-2019-5819 CVE-2019-5820 CVE-2019-5821 CVE-2019-5822 CVE-2019-5823 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Security update to version 74.0.3729.108 (boo#1133313). Security issues fixed: - CVE-2019-5805: Use after free in PDFium - CVE-2019-5806: Integer overflow in Angle - CVE-2019-5807: Memory corruption in V8 - CVE-2019-5808: Use after free in Blink - CVE-2019-5809: Use after free in Blink - CVE-2019-5810: User information disclosure in Autofill - CVE-2019-5811: CORS bypass in Blink - CVE-2019-5813: Out of bounds read in V8 - CVE-2019-5814: CORS bypass in Blink - CVE-2019-5815: Heap buffer overflow in Blink - CVE-2019-5818: Uninitialized value in media reader - CVE-2019-5819: Incorrect escaping in developer tools - CVE-2019-5820: Integer overflow in PDFium - CVE-2019-5821: Integer overflow in PDFium - CVE-2019-5822: CORS bypass in download manager - CVE-2019-5823: Forced navigation from service worker Bug fixes: - Update to 73.0.3686.103: * Various feature fixes - Update to 73.0.3683.86: * Various feature fixes - Update conditions to use system harfbuzz on TW+ - Require java during build - Enable using pipewire when available - Rebase chromium-vaapi.patch to match up the Fedora one Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1324=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-74.0.3729.108-208.1 chromedriver-debuginfo-74.0.3729.108-208.1 chromium-74.0.3729.108-208.1 chromium-debuginfo-74.0.3729.108-208.1 chromium-debugsource-74.0.3729.108-208.1 References: https://www.suse.com/security/cve/CVE-2019-5805.html https://www.suse.com/security/cve/CVE-2019-5806.html https://www.suse.com/security/cve/CVE-2019-5807.html https://www.suse.com/security/cve/CVE-2019-5808.html https://www.suse.com/security/cve/CVE-2019-5809.html https://www.suse.com/security/cve/CVE-2019-5810.html https://www.suse.com/security/cve/CVE-2019-5811.html https://www.suse.com/security/cve/CVE-2019-5813.html https://www.suse.com/security/cve/CVE-2019-5814.html https://www.suse.com/security/cve/CVE-2019-5815.html https://www.suse.com/security/cve/CVE-2019-5818.html https://www.suse.com/security/cve/CVE-2019-5819.html https://www.suse.com/security/cve/CVE-2019-5820.html https://www.suse.com/security/cve/CVE-2019-5821.html https://www.suse.com/security/cve/CVE-2019-5822.html https://www.suse.com/security/cve/CVE-2019-5823.html https://bugzilla.suse.com/1133313 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1327-1: moderate: Security update for java-11-openjdk
by opensuse-security＠opensuse.org 04 May '19

04 May '19

openSUSE Security Update: Security update for java-11-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1327-1 Rating: moderate References: #1132728 #1132732 Cross-References: CVE-2019-2602 CVE-2019-2684 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for java-11-openjdk to version 11.0.3+7 fixes the following issues: Security issues fixed: - CVE-2019-2602: Fixed excessive use of CPU time in the BigDecimal implementation (bsc#1132728). - CVE-2019-2684: Fixed a flaw in the RMI registry implementation which could lead to selection of an incorrect skeleton class (bsc#1132732). Non-security issues fixed: - Multiple bug fixes and improvements. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1327=1 Package List: - openSUSE Leap 15.0 (noarch): java-11-openjdk-javadoc-11.0.3.0-lp150.2.16.1 - openSUSE Leap 15.0 (x86_64): java-11-openjdk-11.0.3.0-lp150.2.16.1 java-11-openjdk-accessibility-11.0.3.0-lp150.2.16.1 java-11-openjdk-accessibility-debuginfo-11.0.3.0-lp150.2.16.1 java-11-openjdk-debuginfo-11.0.3.0-lp150.2.16.1 java-11-openjdk-debugsource-11.0.3.0-lp150.2.16.1 java-11-openjdk-demo-11.0.3.0-lp150.2.16.1 java-11-openjdk-devel-11.0.3.0-lp150.2.16.1 java-11-openjdk-headless-11.0.3.0-lp150.2.16.1 java-11-openjdk-jmods-11.0.3.0-lp150.2.16.1 java-11-openjdk-src-11.0.3.0-lp150.2.16.1 References: https://www.suse.com/security/cve/CVE-2019-2602.html https://www.suse.com/security/cve/CVE-2019-2684.html https://bugzilla.suse.com/1132728 https://bugzilla.suse.com/1132732 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1320-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 03 May '19

03 May '19

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1320-1 Rating: moderate References: #1106989 #1106996 #1107609 #1120381 #1122033 #1124365 #1124366 #1124368 #1128649 #1130330 #1131317 #1132053 #1132054 #1132060 Cross-References: CVE-2018-16412 CVE-2018-16413 CVE-2018-16644 CVE-2018-20467 CVE-2019-10650 CVE-2019-11007 CVE-2019-11008 CVE-2019-11009 CVE-2019-7175 CVE-2019-7395 CVE-2019-7397 CVE-2019-7398 CVE-2019-9956 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 13 vulnerabilities and has one errata is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2019-9956: Fixed a stack-based buffer overflow in PopHexPixel() (bsc#1130330). - CVE-2019-10650: Fixed a heap-based buffer over-read in WriteTIFFImage() (bsc#1131317). - CVE-2019-7175: Fixed multiple memory leaks in DecodeImage function (bsc#1128649). - CVE-2018-20467: Fixed infinite loop in coders/bmp.c (bsc#1120381). - CVE-2019-7398: Fixed a memory leak in the function WriteDIBImage (bsc#1124365). - CVE-2019-7397: Fixed a memory leak in the function WritePDFImage (bsc#1124366). - CVE-2019-7395: Fixed a memory leak in the function WritePSDChannel (bsc#1124368). - CVE-2018-16413: Fixed a heap-based buffer over-read in PushShortPixel() (bsc#1106989). - CVE-2018-16412: Fixed a heap-based buffer over-read in ParseImageResourceBlocks() (bsc#1106996). - CVE-2018-16644: Fixed a regression in dcm coder (bsc#1107609). - CVE-2019-11007: Fixed a heap-based buffer overflow in ReadMNGImage() (bsc#1132060). - CVE-2019-11008: Fixed a heap-based buffer overflow in WriteXWDImage() (bsc#1132054). - CVE-2019-11009: Fixed a heap-based buffer over-read in ReadXWDImage() (bsc#1132053). - Added extra -config- packages with Postscript/EPS/PDF readers still enabled. Removing the PS decoders is used to harden ImageMagick against security issues within ghostscript. Enabling them might impact security. (bsc#1122033) These are two packages that can be selected: - ImageMagick-config-6-SUSE: This has the PS decoders disabled. - ImageMagick-config-6-upstream: This has the PS decoders enabled. Depending on your local needs install either one of them. The default is the -SUSE configuration. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1320=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ImageMagick-6.8.8.1-82.1 ImageMagick-config-6-SUSE-6.8.8.1-82.1 ImageMagick-config-6-upstream-6.8.8.1-82.1 ImageMagick-debuginfo-6.8.8.1-82.1 ImageMagick-debugsource-6.8.8.1-82.1 ImageMagick-devel-6.8.8.1-82.1 ImageMagick-extra-6.8.8.1-82.1 ImageMagick-extra-debuginfo-6.8.8.1-82.1 libMagick++-6_Q16-3-6.8.8.1-82.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-82.1 libMagick++-devel-6.8.8.1-82.1 libMagickCore-6_Q16-1-6.8.8.1-82.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-82.1 libMagickWand-6_Q16-1-6.8.8.1-82.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-82.1 perl-PerlMagick-6.8.8.1-82.1 perl-PerlMagick-debuginfo-6.8.8.1-82.1 - openSUSE Leap 42.3 (noarch): ImageMagick-doc-6.8.8.1-82.1 - openSUSE Leap 42.3 (x86_64): ImageMagick-devel-32bit-6.8.8.1-82.1 libMagick++-6_Q16-3-32bit-6.8.8.1-82.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-82.1 libMagick++-devel-32bit-6.8.8.1-82.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-82.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-82.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-82.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-82.1 References: https://www.suse.com/security/cve/CVE-2018-16412.html https://www.suse.com/security/cve/CVE-2018-16413.html https://www.suse.com/security/cve/CVE-2018-16644.html https://www.suse.com/security/cve/CVE-2018-20467.html https://www.suse.com/security/cve/CVE-2019-10650.html https://www.suse.com/security/cve/CVE-2019-11007.html https://www.suse.com/security/cve/CVE-2019-11008.html https://www.suse.com/security/cve/CVE-2019-11009.html https://www.suse.com/security/cve/CVE-2019-7175.html https://www.suse.com/security/cve/CVE-2019-7395.html https://www.suse.com/security/cve/CVE-2019-7397.html https://www.suse.com/security/cve/CVE-2019-7398.html https://www.suse.com/security/cve/CVE-2019-9956.html https://bugzilla.suse.com/1106989 https://bugzilla.suse.com/1106996 https://bugzilla.suse.com/1107609 https://bugzilla.suse.com/1120381 https://bugzilla.suse.com/1122033 https://bugzilla.suse.com/1124365 https://bugzilla.suse.com/1124366 https://bugzilla.suse.com/1124368 https://bugzilla.suse.com/1128649 https://bugzilla.suse.com/1130330 https://bugzilla.suse.com/1131317 https://bugzilla.suse.com/1132053 https://bugzilla.suse.com/1132054 https://bugzilla.suse.com/1132060 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1316-1: moderate: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 02 May '19

02 May '19

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1316-1 Rating: moderate References: #1126768 Cross-References: CVE-2019-8375 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for webkit2gtk3 fixes the following issues: Security issue fixed: - CVE-2019-8375: Fixed an issue in UIProcess subsystem which could allow the script dialog size to exceed the web view size leading to Buffer Overflow or other unspecified impact (bsc#1126768). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1316=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.24.0-24.1 libjavascriptcoregtk-4_0-18-debuginfo-2.24.0-24.1 libwebkit2gtk-4_0-37-2.24.0-24.1 libwebkit2gtk-4_0-37-debuginfo-2.24.0-24.1 typelib-1_0-JavaScriptCore-4_0-2.24.0-24.1 typelib-1_0-WebKit2-4_0-2.24.0-24.1 typelib-1_0-WebKit2WebExtension-4_0-2.24.0-24.1 webkit-jsc-4-2.24.0-24.1 webkit-jsc-4-debuginfo-2.24.0-24.1 webkit2gtk-4_0-injected-bundles-2.24.0-24.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.24.0-24.1 webkit2gtk3-debugsource-2.24.0-24.1 webkit2gtk3-devel-2.24.0-24.1 webkit2gtk3-minibrowser-2.24.0-24.1 webkit2gtk3-minibrowser-debuginfo-2.24.0-24.1 webkit2gtk3-plugin-process-gtk2-2.24.0-24.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.24.0-24.1 - openSUSE Leap 42.3 (noarch): libwebkit2gtk3-lang-2.24.0-24.1 - openSUSE Leap 42.3 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.24.0-24.1 libjavascriptcoregtk-4_0-18-debuginfo-32bit-2.24.0-24.1 libwebkit2gtk-4_0-37-32bit-2.24.0-24.1 libwebkit2gtk-4_0-37-debuginfo-32bit-2.24.0-24.1 References: https://www.suse.com/security/cve/CVE-2019-8375.html https://bugzilla.suse.com/1126768 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1315-1: moderate: Security update for jasper
by opensuse-security＠opensuse.org 02 May '19

02 May '19

openSUSE Security Update: Security update for jasper ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1315-1 Rating: moderate References: #1010783 #1117505 #1117511 Cross-References: CVE-2016-9396 CVE-2018-19539 CVE-2018-19542 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for jasper fixes the following issues: Security issues fixed: - CVE-2018-19542: Fixed a denial of service in jp2_decode (bsc#1117505). - CVE-2018-19539: Fixed a denial of service in jas_image_readcmpt (bsc#1117511). - CVE-2016-9396: Fixed a denial of service in jpc_cox_getcompparms (bsc#1010783). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1315=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): jasper-2.0.14-lp150.2.3.1 jasper-debuginfo-2.0.14-lp150.2.3.1 jasper-debugsource-2.0.14-lp150.2.3.1 libjasper-devel-2.0.14-lp150.2.3.1 libjasper4-2.0.14-lp150.2.3.1 libjasper4-debuginfo-2.0.14-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libjasper4-32bit-2.0.14-lp150.2.3.1 libjasper4-32bit-debuginfo-2.0.14-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2016-9396.html https://www.suse.com/security/cve/CVE-2018-19539.html https://www.suse.com/security/cve/CVE-2018-19542.html https://bugzilla.suse.com/1010783 https://bugzilla.suse.com/1117505 https://bugzilla.suse.com/1117511 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0