September 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:2081-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2081-1 Rating: moderate References: #1146219 #1149143 Cross-References: CVE-2019-5869 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for chromium fixes the following issues: Security issues fixed: - CVE-2019-5869: Fixed use-after-free in Blink (boo#1149143). - Various fixes from internal audits, fuzzing and other initiatives. Non-security issues fixed: - Fixed no video playback on Intel Kaby Lake and later (boo#1146219). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2081=1 Package List: - openSUSE Leap 15.0 (x86_64): chromedriver-76.0.3809.132-lp150.234.1 chromedriver-debuginfo-76.0.3809.132-lp150.234.1 chromium-76.0.3809.132-lp150.234.1 chromium-debuginfo-76.0.3809.132-lp150.234.1 chromium-debugsource-76.0.3809.132-lp150.234.1 References: https://www.suse.com/security/cve/CVE-2019-5869.html https://bugzilla.suse.com/1146219 https://bugzilla.suse.com/1149143 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2080-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2080-1 Rating: moderate References: #1146219 #1149143 Cross-References: CVE-2019-5869 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for chromium fixes the following issues: Security issues fixed: - CVE-2019-5869: Fixed use-after-free in Blink (boo#1149143). - Various fixes from internal audits, fuzzing and other initiatives. Non-security issues fixed: - Fixed no video playback on Intel Kaby Lake and later (boo#1146219). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2080=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-76.0.3809.132-lp151.2.25.1 chromedriver-debuginfo-76.0.3809.132-lp151.2.25.1 chromium-76.0.3809.132-lp151.2.25.1 chromium-debuginfo-76.0.3809.132-lp151.2.25.1 chromium-debugsource-76.0.3809.132-lp151.2.25.1 References: https://www.suse.com/security/cve/CVE-2019-5869.html https://bugzilla.suse.com/1146219 https://bugzilla.suse.com/1149143 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2077-1: moderate: Security update for libmirage
by opensuse-security＠opensuse.org 06 Sep '19

06 Sep '19

openSUSE Security Update: Security update for libmirage ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2077-1 Rating: moderate References: #1148087 Cross-References: CVE-2019-15540 Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libmirage fixes the following issues: CVE-2019-15540: The CSO filter in libMirage in CDemu did not validate the part size, triggering a heap-based buffer overflow that could lead to root access by a local user. [boo#1148087] - Update to new upstream release 3.2.2 * ISO parser: fixed ISO9660/UDF pattern search for sector sizes 2332 and 2336. * ISO parser: added support for Nintendo GameCube and Wii ISO images. * Extended medium type guess to distinguish between DVD and BluRay images based on length. * Removed fabrication of disc structures from the library (moved to CDEmu daemon). * MDS parser: cleanup of disc structure parsing, fixed the incorrectly set structure sizes. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2077=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2077=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libmirage-3_2-3.2.2-bp151.4.3.1 libmirage-3_2-debuginfo-3.2.2-bp151.4.3.1 libmirage-debuginfo-3.2.2-bp151.4.3.1 libmirage-debugsource-3.2.2-bp151.4.3.1 libmirage-devel-3.2.2-bp151.4.3.1 libmirage11-3.2.2-bp151.4.3.1 libmirage11-debuginfo-3.2.2-bp151.4.3.1 typelib-1_0-libmirage-3_2-3.2.2-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (noarch): libmirage-data-3.2.2-bp151.4.3.1 libmirage-lang-3.2.2-bp151.4.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libmirage-3_2-3.2.2-bp150.3.3.1 libmirage-devel-3.2.2-bp150.3.3.1 libmirage11-3.2.2-bp150.3.3.1 typelib-1_0-libmirage-3_2-3.2.2-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): libmirage-data-3.2.2-bp150.3.3.1 libmirage-lang-3.2.2-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-15540.html https://bugzilla.suse.com/1148087 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2078-1: important: Security update for python-SQLAlchemy
by opensuse-security＠opensuse.org 06 Sep '19

06 Sep '19

openSUSE Security Update: Security update for python-SQLAlchemy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2078-1 Rating: important References: #1124593 Cross-References: CVE-2019-7164 CVE-2019-7548 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python-SQLAlchemy fixes the following issues: Security issues fixed: - CVE-2019-7164: Fixed SQL Injection via the order_by parameter (bsc#1124593). - CVE-2019-7548: Fixed SQL Injection via the group_by parameter (bsc#1124593). This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2078=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): python2-SQLAlchemy-1.2.7-bp150.2.3.1 python3-SQLAlchemy-1.2.7-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): python-SQLAlchemy-doc-1.2.7-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-7164.html https://www.suse.com/security/cve/CVE-2019-7548.html https://bugzilla.suse.com/1124593 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2067-1: Security update for wavpack
by opensuse-security＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Security Update: Security update for wavpack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2067-1 Rating: low References: #1133384 #1141334 Cross-References: CVE-2019-1010319 CVE-2019-11498 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for wavpack fixes the following issues: Security issues fixed: - CVE-2019-1010319: Fixed use of uninitialized variable in ParseWave64HeaderConfig that can result in unexpected control flow, crashes, and segfaults (bsc#1141334). - CVE-2019-11498: Fixed possible denial of service (application crash) in WavpackSetConfiguration64 via a DFF file that lacks valid sample-rate data (bsc#1133384). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2067=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2067=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libwavpack1-5.1.0-lp151.5.3.1 libwavpack1-debuginfo-5.1.0-lp151.5.3.1 wavpack-5.1.0-lp151.5.3.1 wavpack-debuginfo-5.1.0-lp151.5.3.1 wavpack-debugsource-5.1.0-lp151.5.3.1 wavpack-devel-5.1.0-lp151.5.3.1 - openSUSE Leap 15.1 (x86_64): libwavpack1-32bit-5.1.0-lp151.5.3.1 libwavpack1-32bit-debuginfo-5.1.0-lp151.5.3.1 - openSUSE Leap 15.0 (i586 x86_64): libwavpack1-5.1.0-lp150.3.6.1 libwavpack1-debuginfo-5.1.0-lp150.3.6.1 wavpack-5.1.0-lp150.3.6.1 wavpack-debuginfo-5.1.0-lp150.3.6.1 wavpack-debugsource-5.1.0-lp150.3.6.1 wavpack-devel-5.1.0-lp150.3.6.1 - openSUSE Leap 15.0 (x86_64): libwavpack1-32bit-5.1.0-lp150.3.6.1 libwavpack1-32bit-debuginfo-5.1.0-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-1010319.html https://www.suse.com/security/cve/CVE-2019-11498.html https://bugzilla.suse.com/1133384 https://bugzilla.suse.com/1141334 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2071-1: moderate: Security update for SDL_image
by opensuse-security＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Security Update: Security update for SDL_image ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2071-1 Rating: moderate References: #1124827 #1140421 #1141844 #1143763 #1143764 #1143766 #1143768 Cross-References: CVE-2019-13616 CVE-2019-5052 CVE-2019-5057 CVE-2019-5058 CVE-2019-5059 CVE-2019-5060 CVE-2019-7635 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for SDL_image fixes the following issues: Update SDL_Image to new snapshot 1.2.12+hg695. Security issues fixed: * TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421) * TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763) * TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764) * TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image handling (boo#1143766) * TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768) * CVE-2019-7635: heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c (boo#1124827) * CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2071=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2071=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): SDL_image-debugsource-1.2.12+hg695-lp151.3.3.1 libSDL_image-1_2-0-1.2.12+hg695-lp151.3.3.1 libSDL_image-1_2-0-debuginfo-1.2.12+hg695-lp151.3.3.1 libSDL_image-devel-1.2.12+hg695-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libSDL_image-1_2-0-32bit-1.2.12+hg695-lp151.3.3.1 libSDL_image-1_2-0-32bit-debuginfo-1.2.12+hg695-lp151.3.3.1 libSDL_image-devel-32bit-1.2.12+hg695-lp151.3.3.1 - openSUSE Leap 15.0 (i586 x86_64): SDL_image-debugsource-1.2.12+hg695-lp150.2.3.1 libSDL_image-1_2-0-1.2.12+hg695-lp150.2.3.1 libSDL_image-1_2-0-debuginfo-1.2.12+hg695-lp150.2.3.1 libSDL_image-devel-1.2.12+hg695-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libSDL_image-1_2-0-32bit-1.2.12+hg695-lp150.2.3.1 libSDL_image-1_2-0-32bit-debuginfo-1.2.12+hg695-lp150.2.3.1 libSDL_image-devel-32bit-1.2.12+hg695-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-13616.html https://www.suse.com/security/cve/CVE-2019-5052.html https://www.suse.com/security/cve/CVE-2019-5057.html https://www.suse.com/security/cve/CVE-2019-5058.html https://www.suse.com/security/cve/CVE-2019-5059.html https://www.suse.com/security/cve/CVE-2019-5060.html https://www.suse.com/security/cve/CVE-2019-7635.html https://bugzilla.suse.com/1124827 https://bugzilla.suse.com/1140421 https://bugzilla.suse.com/1141844 https://bugzilla.suse.com/1143763 https://bugzilla.suse.com/1143764 https://bugzilla.suse.com/1143766 https://bugzilla.suse.com/1143768 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2068-1: moderate: Security update for python-Twisted
by opensuse-security＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Security Update: Security update for python-Twisted ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2068-1 Rating: moderate References: #1138461 Cross-References: CVE-2019-12855 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Twisted fixes the following issues: Security issue fixed: - CVE-2019-12855: Fixed TLS certificate verification to protecting against MITM attacks (bsc#1138461). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2068=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2068=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): python-Twisted-debuginfo-17.9.0-lp151.3.6.1 python-Twisted-debugsource-17.9.0-lp151.3.6.1 python-Twisted-doc-17.9.0-lp151.3.6.1 python2-Twisted-17.9.0-lp151.3.6.1 python2-Twisted-debuginfo-17.9.0-lp151.3.6.1 python3-Twisted-17.9.0-lp151.3.6.1 python3-Twisted-debuginfo-17.9.0-lp151.3.6.1 - openSUSE Leap 15.0 (i586 x86_64): python-Twisted-debuginfo-17.9.0-lp150.2.6.1 python-Twisted-debugsource-17.9.0-lp150.2.6.1 python-Twisted-doc-17.9.0-lp150.2.6.1 python2-Twisted-17.9.0-lp150.2.6.1 python2-Twisted-debuginfo-17.9.0-lp150.2.6.1 python3-Twisted-17.9.0-lp150.2.6.1 python3-Twisted-debuginfo-17.9.0-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-12855.html https://bugzilla.suse.com/1138461 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2070-1: moderate: Security update for SDL2_image
by opensuse-security＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Security Update: Security update for SDL2_image ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2070-1 Rating: moderate References: #1135787 #1135789 #1135796 #1135806 #1136101 #1140419 #1140421 #1141844 #1143763 #1143764 #1143766 #1143768 Cross-References: CVE-2019-12217 CVE-2019-12218 CVE-2019-12220 CVE-2019-12221 CVE-2019-12222 CVE-2019-13616 CVE-2019-5051 CVE-2019-5052 CVE-2019-5057 CVE-2019-5058 CVE-2019-5059 CVE-2019-5060 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for SDL2_image fixes the following issues: Update to new upstream release 2.0.5. Security issues fixed: * TALOS-2019-0820 CVE-2019-5051: exploitable heap-based buffer overflow vulnerability when loading a PCX file (boo#1140419) * TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421) * TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763) * TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764) * TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image (boo#1143766) * TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768) Not mentioned by upstream, but issues seemingly further fixed: * CVE-2019-12218: NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW (boo#1135789) * CVE-2019-12217: NULL pointer dereference in the SDL stdio_read function (boo#1135787) * CVE-2019-12220: SDL_image triggers an out-of-bounds read in the SDL function SDL_FreePalette_REAL (boo#1135806) * CVE-2019-12221: a SEGV caused by SDL_image in SDL function SDL_free_REAL in stdlib/SDL_malloc.c (boo#1135796) * CVE-2019-12222: out-of-bounds read triggered by SDL_image in the function SDL_InvalidateMap at video/SDL_pixels.c (boo#1136101) * CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2070=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2070=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): SDL2_image-debugsource-2.0.5-lp151.2.5.1 libSDL2_image-2_0-0-2.0.5-lp151.2.5.1 libSDL2_image-2_0-0-debuginfo-2.0.5-lp151.2.5.1 libSDL2_image-devel-2.0.5-lp151.2.5.1 - openSUSE Leap 15.1 (x86_64): libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1 libSDL2_image-2_0-0-32bit-debuginfo-2.0.5-lp151.2.5.1 libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1 - openSUSE Leap 15.0 (i586 x86_64): SDL2_image-debugsource-2.0.5-lp150.9.1 libSDL2_image-2_0-0-2.0.5-lp150.9.1 libSDL2_image-2_0-0-debuginfo-2.0.5-lp150.9.1 libSDL2_image-devel-2.0.5-lp150.9.1 - openSUSE Leap 15.0 (x86_64): libSDL2_image-2_0-0-32bit-2.0.5-lp150.9.1 libSDL2_image-2_0-0-32bit-debuginfo-2.0.5-lp150.9.1 libSDL2_image-devel-32bit-2.0.5-lp150.9.1 References: https://www.suse.com/security/cve/CVE-2019-12217.html https://www.suse.com/security/cve/CVE-2019-12218.html https://www.suse.com/security/cve/CVE-2019-12220.html https://www.suse.com/security/cve/CVE-2019-12221.html https://www.suse.com/security/cve/CVE-2019-12222.html https://www.suse.com/security/cve/CVE-2019-13616.html https://www.suse.com/security/cve/CVE-2019-5051.html https://www.suse.com/security/cve/CVE-2019-5052.html https://www.suse.com/security/cve/CVE-2019-5057.html https://www.suse.com/security/cve/CVE-2019-5058.html https://www.suse.com/security/cve/CVE-2019-5059.html https://www.suse.com/security/cve/CVE-2019-5060.html https://bugzilla.suse.com/1135787 https://bugzilla.suse.com/1135789 https://bugzilla.suse.com/1135796 https://bugzilla.suse.com/1135806 https://bugzilla.suse.com/1136101 https://bugzilla.suse.com/1140419 https://bugzilla.suse.com/1140421 https://bugzilla.suse.com/1141844 https://bugzilla.suse.com/1143763 https://bugzilla.suse.com/1143764 https://bugzilla.suse.com/1143766 https://bugzilla.suse.com/1143768 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2072-1: moderate: Security update for go1.11
by opensuse-security＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Security Update: Security update for go1.11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2072-1 Rating: moderate References: #1141688 #1146111 #1146115 #1146123 Cross-References: CVE-2019-14809 CVE-2019-9512 CVE-2019-9514 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for go1.11 fixes the following issues: Security issues fixed: - CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115). - CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123). Bugfixes: - Update to go version 1.11.13 (bsc#1141688). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2072=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2072=1 Package List: - openSUSE Leap 15.1 (x86_64): go1.11-1.11.13-lp151.2.9.1 go1.11-doc-1.11.13-lp151.2.9.1 go1.11-race-1.11.13-lp151.2.9.1 - openSUSE Leap 15.0 (x86_64): go1.11-1.11.13-lp150.18.1 go1.11-doc-1.11.13-lp150.18.1 go1.11-race-1.11.13-lp150.18.1 References: https://www.suse.com/security/cve/CVE-2019-14809.html https://www.suse.com/security/cve/CVE-2019-9512.html https://www.suse.com/security/cve/CVE-2019-9514.html https://bugzilla.suse.com/1141688 https://bugzilla.suse.com/1146111 https://bugzilla.suse.com/1146115 https://bugzilla.suse.com/1146123 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2064-1: important: Security update for python-SQLAlchemy
by opensuse-security＠opensuse.org 04 Sep '19

04 Sep '19

openSUSE Security Update: Security update for python-SQLAlchemy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2064-1 Rating: important References: #1124593 Cross-References: CVE-2019-7164 CVE-2019-7548 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python-SQLAlchemy fixes the following issues: Security issues fixed: - CVE-2019-7164: Fixed SQL Injection via the order_by parameter (bsc#1124593). - CVE-2019-7548: Fixed SQL Injection via the group_by parameter (bsc#1124593). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2064=1 Package List: - openSUSE Leap 15.1 (noarch): python-SQLAlchemy-doc-1.2.14-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): python-SQLAlchemy-debuginfo-1.2.14-lp151.2.3.1 python-SQLAlchemy-debugsource-1.2.14-lp151.2.3.1 python2-SQLAlchemy-1.2.14-lp151.2.3.1 python2-SQLAlchemy-debuginfo-1.2.14-lp151.2.3.1 python3-SQLAlchemy-1.2.14-lp151.2.3.1 python3-SQLAlchemy-debuginfo-1.2.14-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-7164.html https://www.suse.com/security/cve/CVE-2019-7548.html https://bugzilla.suse.com/1124593 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2062-1: important: Security update for postgresql10
by opensuse-security＠opensuse.org 03 Sep '19

03 Sep '19

openSUSE Security Update: Security update for postgresql10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2062-1 Rating: important References: #1145092 Cross-References: CVE-2019-10208 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql10 fixes the following issues: Security issue fixed: - CVE-2019-10208: Fixed arbitrary SQL execution via suitable SECURITY DEFINER function under the identity of the function owner (bsc#1145092). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2062=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2062=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libecpg6-10.10-lp151.2.6.1 libecpg6-debuginfo-10.10-lp151.2.6.1 libpq5-10.10-lp151.2.6.1 libpq5-debuginfo-10.10-lp151.2.6.1 postgresql10-10.10-lp151.2.6.1 postgresql10-contrib-10.10-lp151.2.6.1 postgresql10-contrib-debuginfo-10.10-lp151.2.6.1 postgresql10-debuginfo-10.10-lp151.2.6.1 postgresql10-debugsource-10.10-lp151.2.6.1 postgresql10-devel-10.10-lp151.2.6.1 postgresql10-devel-debuginfo-10.10-lp151.2.6.1 postgresql10-plperl-10.10-lp151.2.6.1 postgresql10-plperl-debuginfo-10.10-lp151.2.6.1 postgresql10-plpython-10.10-lp151.2.6.1 postgresql10-plpython-debuginfo-10.10-lp151.2.6.1 postgresql10-pltcl-10.10-lp151.2.6.1 postgresql10-pltcl-debuginfo-10.10-lp151.2.6.1 postgresql10-server-10.10-lp151.2.6.1 postgresql10-server-debuginfo-10.10-lp151.2.6.1 postgresql10-test-10.10-lp151.2.6.1 - openSUSE Leap 15.1 (x86_64): libecpg6-32bit-10.10-lp151.2.6.1 libecpg6-32bit-debuginfo-10.10-lp151.2.6.1 libpq5-32bit-10.10-lp151.2.6.1 libpq5-32bit-debuginfo-10.10-lp151.2.6.1 - openSUSE Leap 15.1 (noarch): postgresql10-docs-10.10-lp151.2.6.1 - openSUSE Leap 15.0 (i586 x86_64): libecpg6-10.10-lp150.3.13.1 libecpg6-debuginfo-10.10-lp150.3.13.1 libpq5-10.10-lp150.3.13.1 libpq5-debuginfo-10.10-lp150.3.13.1 postgresql10-10.10-lp150.3.13.1 postgresql10-contrib-10.10-lp150.3.13.1 postgresql10-contrib-debuginfo-10.10-lp150.3.13.1 postgresql10-debuginfo-10.10-lp150.3.13.1 postgresql10-debugsource-10.10-lp150.3.13.1 postgresql10-devel-10.10-lp150.3.13.1 postgresql10-devel-debuginfo-10.10-lp150.3.13.1 postgresql10-plperl-10.10-lp150.3.13.1 postgresql10-plperl-debuginfo-10.10-lp150.3.13.1 postgresql10-plpython-10.10-lp150.3.13.1 postgresql10-plpython-debuginfo-10.10-lp150.3.13.1 postgresql10-pltcl-10.10-lp150.3.13.1 postgresql10-pltcl-debuginfo-10.10-lp150.3.13.1 postgresql10-server-10.10-lp150.3.13.1 postgresql10-server-debuginfo-10.10-lp150.3.13.1 postgresql10-test-10.10-lp150.3.13.1 - openSUSE Leap 15.0 (x86_64): libecpg6-32bit-10.10-lp150.3.13.1 libecpg6-32bit-debuginfo-10.10-lp150.3.13.1 libpq5-32bit-10.10-lp150.3.13.1 libpq5-32bit-debuginfo-10.10-lp150.3.13.1 - openSUSE Leap 15.0 (noarch): postgresql10-docs-10.10-lp150.3.13.1 References: https://www.suse.com/security/cve/CVE-2019-10208.html https://bugzilla.suse.com/1145092 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2059-1: important: Security update for qemu
by opensuse-security＠opensuse.org 03 Sep '19

03 Sep '19

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2059-1 Rating: important References: #1079730 #1098403 #1111025 #1119115 #1134883 #1135902 #1136540 #1136778 #1140402 #1143794 Cross-References: CVE-2019-12155 CVE-2019-13164 CVE-2019-14378 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has 7 fixes is now available. Description: This update for qemu fixes the following issues: Security issues fixed: - CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794). - CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902). - CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402). Bug fixes and enhancements: - Add vcpu features needed for Cascadelake-Server, Icelake-Client and Icelake-Server, especially the foundational arch-capabilities to help with security and performance on Intel hosts (bsc#1134883) (fate#327764) - Add support for one more security/performance related vcpu feature (bsc#1136778) (fate#327796) - Disable file locking in the Xen PV disk backend to avoid locking issues with PV domUs during migration. The issues triggered by the locking can not be properly handled in libxl. The locking introduced in qemu-2.10 was removed again in qemu-4.0 (bsc#1079730, bsc#1098403, bsc#1111025). - Ignore csske for expanding the cpu model (bsc#1136540) - Fix vm migration is failing with input/output error when nfs server is disconnected (bsc#1119115) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2059=1 Package List: - openSUSE Leap 15.0 (x86_64): qemu-2.11.2-lp150.7.25.1 qemu-arm-2.11.2-lp150.7.25.1 qemu-arm-debuginfo-2.11.2-lp150.7.25.1 qemu-block-curl-2.11.2-lp150.7.25.1 qemu-block-curl-debuginfo-2.11.2-lp150.7.25.1 qemu-block-dmg-2.11.2-lp150.7.25.1 qemu-block-dmg-debuginfo-2.11.2-lp150.7.25.1 qemu-block-gluster-2.11.2-lp150.7.25.1 qemu-block-gluster-debuginfo-2.11.2-lp150.7.25.1 qemu-block-iscsi-2.11.2-lp150.7.25.1 qemu-block-iscsi-debuginfo-2.11.2-lp150.7.25.1 qemu-block-rbd-2.11.2-lp150.7.25.1 qemu-block-rbd-debuginfo-2.11.2-lp150.7.25.1 qemu-block-ssh-2.11.2-lp150.7.25.1 qemu-block-ssh-debuginfo-2.11.2-lp150.7.25.1 qemu-debuginfo-2.11.2-lp150.7.25.1 qemu-debugsource-2.11.2-lp150.7.25.1 qemu-extra-2.11.2-lp150.7.25.1 qemu-extra-debuginfo-2.11.2-lp150.7.25.1 qemu-guest-agent-2.11.2-lp150.7.25.1 qemu-guest-agent-debuginfo-2.11.2-lp150.7.25.1 qemu-ksm-2.11.2-lp150.7.25.1 qemu-kvm-2.11.2-lp150.7.25.1 qemu-lang-2.11.2-lp150.7.25.1 qemu-ppc-2.11.2-lp150.7.25.1 qemu-ppc-debuginfo-2.11.2-lp150.7.25.1 qemu-s390-2.11.2-lp150.7.25.1 qemu-s390-debuginfo-2.11.2-lp150.7.25.1 qemu-tools-2.11.2-lp150.7.25.1 qemu-tools-debuginfo-2.11.2-lp150.7.25.1 qemu-x86-2.11.2-lp150.7.25.1 qemu-x86-debuginfo-2.11.2-lp150.7.25.1 - openSUSE Leap 15.0 (noarch): qemu-ipxe-1.0.0+-lp150.7.25.1 qemu-seabios-1.11.0-lp150.7.25.1 qemu-sgabios-8-lp150.7.25.1 qemu-vgabios-1.11.0-lp150.7.25.1 References: https://www.suse.com/security/cve/CVE-2019-12155.html https://www.suse.com/security/cve/CVE-2019-13164.html https://www.suse.com/security/cve/CVE-2019-14378.html https://bugzilla.suse.com/1079730 https://bugzilla.suse.com/1098403 https://bugzilla.suse.com/1111025 https://bugzilla.suse.com/1119115 https://bugzilla.suse.com/1134883 https://bugzilla.suse.com/1135902 https://bugzilla.suse.com/1136540 https://bugzilla.suse.com/1136778 https://bugzilla.suse.com/1140402 https://bugzilla.suse.com/1143794 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2058-1: important: Security update for apache-commons-beanutils
by opensuse-security＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Security Update: Security update for apache-commons-beanutils ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2058-1 Rating: important References: #1146657 Cross-References: CVE-2019-10086 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for apache-commons-beanutils fixes the following issues: Security issue fixed: - CVE-2019-10086: Added special BeanIntrospector class which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects (bsc#1146657). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2058=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2058=1 Package List: - openSUSE Leap 15.1 (noarch): apache-commons-beanutils-1.9.2-lp151.3.3.1 apache-commons-beanutils-javadoc-1.9.2-lp151.3.3.1 - openSUSE Leap 15.0 (noarch): apache-commons-beanutils-1.9.2-lp150.2.3.1 apache-commons-beanutils-javadoc-1.9.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-10086.html https://bugzilla.suse.com/1146657 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2057-1: important: Security update for libreoffice
by opensuse-security＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Security Update: Security update for libreoffice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2057-1 Rating: important References: #1133534 #1141861 #1141862 #1146098 #1146105 #1146107 Cross-References: CVE-2019-9848 CVE-2019-9849 CVE-2019-9850 CVE-2019-9851 CVE-2019-9852 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for libreoffice fixes the following issues: Security issues fixed: - CVE-2019-9849: Disabled fetching remote bullet graphics in 'stealth mode' (bsc#1141861). - CVE-2019-9848: Fixed an arbitrary script execution via LibreLogo (bsc#1141862). - CVE-2019-9851: Fixed LibreLogo global-event script execution issue (bsc#1146105). - CVE-2019-9852: Fixed insufficient URL encoding flaw in allowed script location check (bsc#1146107). - CVE-2019-9850: Fixed insufficient URL validation that allowed LibreLogo script execution (bsc#1146098). Non-security issue fixed: - SmartArt: Basic rendering of Trapezoid List (bsc#1133534) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2057=1 Package List: - openSUSE Leap 15.0 (noarch): libreoffice-branding-upstream-6.2.6.2-lp150.2.16.1 libreoffice-gdb-pretty-printers-6.2.6.2-lp150.2.16.1 libreoffice-glade-6.2.6.2-lp150.2.16.1 libreoffice-icon-themes-6.2.6.2-lp150.2.16.1 libreoffice-l10n-af-6.2.6.2-lp150.2.16.1 libreoffice-l10n-am-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ar-6.2.6.2-lp150.2.16.1 libreoffice-l10n-as-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ast-6.2.6.2-lp150.2.16.1 libreoffice-l10n-be-6.2.6.2-lp150.2.16.1 libreoffice-l10n-bg-6.2.6.2-lp150.2.16.1 libreoffice-l10n-bn-6.2.6.2-lp150.2.16.1 libreoffice-l10n-bn_IN-6.2.6.2-lp150.2.16.1 libreoffice-l10n-bo-6.2.6.2-lp150.2.16.1 libreoffice-l10n-br-6.2.6.2-lp150.2.16.1 libreoffice-l10n-brx-6.2.6.2-lp150.2.16.1 libreoffice-l10n-bs-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ca-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ca_valencia-6.2.6.2-lp150.2.16.1 libreoffice-l10n-cs-6.2.6.2-lp150.2.16.1 libreoffice-l10n-cy-6.2.6.2-lp150.2.16.1 libreoffice-l10n-da-6.2.6.2-lp150.2.16.1 libreoffice-l10n-de-6.2.6.2-lp150.2.16.1 libreoffice-l10n-dgo-6.2.6.2-lp150.2.16.1 libreoffice-l10n-dsb-6.2.6.2-lp150.2.16.1 libreoffice-l10n-dz-6.2.6.2-lp150.2.16.1 libreoffice-l10n-el-6.2.6.2-lp150.2.16.1 libreoffice-l10n-en-6.2.6.2-lp150.2.16.1 libreoffice-l10n-en_GB-6.2.6.2-lp150.2.16.1 libreoffice-l10n-en_ZA-6.2.6.2-lp150.2.16.1 libreoffice-l10n-eo-6.2.6.2-lp150.2.16.1 libreoffice-l10n-es-6.2.6.2-lp150.2.16.1 libreoffice-l10n-et-6.2.6.2-lp150.2.16.1 libreoffice-l10n-eu-6.2.6.2-lp150.2.16.1 libreoffice-l10n-fa-6.2.6.2-lp150.2.16.1 libreoffice-l10n-fi-6.2.6.2-lp150.2.16.1 libreoffice-l10n-fr-6.2.6.2-lp150.2.16.1 libreoffice-l10n-fy-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ga-6.2.6.2-lp150.2.16.1 libreoffice-l10n-gd-6.2.6.2-lp150.2.16.1 libreoffice-l10n-gl-6.2.6.2-lp150.2.16.1 libreoffice-l10n-gu-6.2.6.2-lp150.2.16.1 libreoffice-l10n-gug-6.2.6.2-lp150.2.16.1 libreoffice-l10n-he-6.2.6.2-lp150.2.16.1 libreoffice-l10n-hi-6.2.6.2-lp150.2.16.1 libreoffice-l10n-hr-6.2.6.2-lp150.2.16.1 libreoffice-l10n-hsb-6.2.6.2-lp150.2.16.1 libreoffice-l10n-hu-6.2.6.2-lp150.2.16.1 libreoffice-l10n-id-6.2.6.2-lp150.2.16.1 libreoffice-l10n-is-6.2.6.2-lp150.2.16.1 libreoffice-l10n-it-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ja-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ka-6.2.6.2-lp150.2.16.1 libreoffice-l10n-kab-6.2.6.2-lp150.2.16.1 libreoffice-l10n-kk-6.2.6.2-lp150.2.16.1 libreoffice-l10n-km-6.2.6.2-lp150.2.16.1 libreoffice-l10n-kmr_Latn-6.2.6.2-lp150.2.16.1 libreoffice-l10n-kn-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ko-6.2.6.2-lp150.2.16.1 libreoffice-l10n-kok-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ks-6.2.6.2-lp150.2.16.1 libreoffice-l10n-lb-6.2.6.2-lp150.2.16.1 libreoffice-l10n-lo-6.2.6.2-lp150.2.16.1 libreoffice-l10n-lt-6.2.6.2-lp150.2.16.1 libreoffice-l10n-lv-6.2.6.2-lp150.2.16.1 libreoffice-l10n-mai-6.2.6.2-lp150.2.16.1 libreoffice-l10n-mk-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ml-6.2.6.2-lp150.2.16.1 libreoffice-l10n-mn-6.2.6.2-lp150.2.16.1 libreoffice-l10n-mni-6.2.6.2-lp150.2.16.1 libreoffice-l10n-mr-6.2.6.2-lp150.2.16.1 libreoffice-l10n-my-6.2.6.2-lp150.2.16.1 libreoffice-l10n-nb-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ne-6.2.6.2-lp150.2.16.1 libreoffice-l10n-nl-6.2.6.2-lp150.2.16.1 libreoffice-l10n-nn-6.2.6.2-lp150.2.16.1 libreoffice-l10n-nr-6.2.6.2-lp150.2.16.1 libreoffice-l10n-nso-6.2.6.2-lp150.2.16.1 libreoffice-l10n-oc-6.2.6.2-lp150.2.16.1 libreoffice-l10n-om-6.2.6.2-lp150.2.16.1 libreoffice-l10n-or-6.2.6.2-lp150.2.16.1 libreoffice-l10n-pa-6.2.6.2-lp150.2.16.1 libreoffice-l10n-pl-6.2.6.2-lp150.2.16.1 libreoffice-l10n-pt_BR-6.2.6.2-lp150.2.16.1 libreoffice-l10n-pt_PT-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ro-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ru-6.2.6.2-lp150.2.16.1 libreoffice-l10n-rw-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sa_IN-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sat-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sd-6.2.6.2-lp150.2.16.1 libreoffice-l10n-si-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sid-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sk-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sl-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sq-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sr-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ss-6.2.6.2-lp150.2.16.1 libreoffice-l10n-st-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sv-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sw_TZ-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ta-6.2.6.2-lp150.2.16.1 libreoffice-l10n-te-6.2.6.2-lp150.2.16.1 libreoffice-l10n-tg-6.2.6.2-lp150.2.16.1 libreoffice-l10n-th-6.2.6.2-lp150.2.16.1 libreoffice-l10n-tn-6.2.6.2-lp150.2.16.1 libreoffice-l10n-tr-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ts-6.2.6.2-lp150.2.16.1 libreoffice-l10n-tt-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ug-6.2.6.2-lp150.2.16.1 libreoffice-l10n-uk-6.2.6.2-lp150.2.16.1 libreoffice-l10n-uz-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ve-6.2.6.2-lp150.2.16.1 libreoffice-l10n-vec-6.2.6.2-lp150.2.16.1 libreoffice-l10n-vi-6.2.6.2-lp150.2.16.1 libreoffice-l10n-xh-6.2.6.2-lp150.2.16.1 libreoffice-l10n-zh_CN-6.2.6.2-lp150.2.16.1 libreoffice-l10n-zh_TW-6.2.6.2-lp150.2.16.1 libreoffice-l10n-zu-6.2.6.2-lp150.2.16.1 - openSUSE Leap 15.0 (x86_64): libreoffice-6.2.6.2-lp150.2.16.1 libreoffice-base-6.2.6.2-lp150.2.16.1 libreoffice-base-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-base-drivers-firebird-6.2.6.2-lp150.2.16.1 libreoffice-base-drivers-firebird-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-base-drivers-postgresql-6.2.6.2-lp150.2.16.1 libreoffice-base-drivers-postgresql-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-calc-6.2.6.2-lp150.2.16.1 libreoffice-calc-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-calc-extensions-6.2.6.2-lp150.2.16.1 libreoffice-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-debugsource-6.2.6.2-lp150.2.16.1 libreoffice-draw-6.2.6.2-lp150.2.16.1 libreoffice-draw-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-filters-optional-6.2.6.2-lp150.2.16.1 libreoffice-gnome-6.2.6.2-lp150.2.16.1 libreoffice-gnome-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-gtk2-6.2.6.2-lp150.2.16.1 libreoffice-gtk2-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-gtk3-6.2.6.2-lp150.2.16.1 libreoffice-gtk3-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-impress-6.2.6.2-lp150.2.16.1 libreoffice-impress-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-mailmerge-6.2.6.2-lp150.2.16.1 libreoffice-math-6.2.6.2-lp150.2.16.1 libreoffice-math-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-officebean-6.2.6.2-lp150.2.16.1 libreoffice-officebean-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-pyuno-6.2.6.2-lp150.2.16.1 libreoffice-pyuno-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-qt5-6.2.6.2-lp150.2.16.1 libreoffice-qt5-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-sdk-6.2.6.2-lp150.2.16.1 libreoffice-sdk-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-sdk-doc-6.2.6.2-lp150.2.16.1 libreoffice-writer-6.2.6.2-lp150.2.16.1 libreoffice-writer-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-writer-extensions-6.2.6.2-lp150.2.16.1 libreofficekit-6.2.6.2-lp150.2.16.1 libreofficekit-devel-6.2.6.2-lp150.2.16.1 References: https://www.suse.com/security/cve/CVE-2019-9848.html https://www.suse.com/security/cve/CVE-2019-9849.html https://www.suse.com/security/cve/CVE-2019-9850.html https://www.suse.com/security/cve/CVE-2019-9851.html https://www.suse.com/security/cve/CVE-2019-9852.html https://bugzilla.suse.com/1133534 https://bugzilla.suse.com/1141861 https://bugzilla.suse.com/1141862 https://bugzilla.suse.com/1146098 https://bugzilla.suse.com/1146105 https://bugzilla.suse.com/1146107 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2052-1: important: Security update for slurm
by opensuse-security＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Security Update: Security update for slurm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2052-1 Rating: important References: #1140709 Cross-References: CVE-2019-12838 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for slurm to version 18.08.8 fixes the following issues: Security issue fixed: - CVE-2019-12838: Fixed a SQL injection in slurmdbd (bsc#1140709). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2052=1 Package List: - openSUSE Leap 15.1 (x86_64): libpmi0-18.08.8-lp151.2.3.1 libpmi0-debuginfo-18.08.8-lp151.2.3.1 libslurm33-18.08.8-lp151.2.3.1 libslurm33-debuginfo-18.08.8-lp151.2.3.1 perl-slurm-18.08.8-lp151.2.3.1 perl-slurm-debuginfo-18.08.8-lp151.2.3.1 slurm-18.08.8-lp151.2.3.1 slurm-auth-none-18.08.8-lp151.2.3.1 slurm-auth-none-debuginfo-18.08.8-lp151.2.3.1 slurm-config-18.08.8-lp151.2.3.1 slurm-config-man-18.08.8-lp151.2.3.1 slurm-cray-18.08.8-lp151.2.3.1 slurm-cray-debuginfo-18.08.8-lp151.2.3.1 slurm-debuginfo-18.08.8-lp151.2.3.1 slurm-debugsource-18.08.8-lp151.2.3.1 slurm-devel-18.08.8-lp151.2.3.1 slurm-doc-18.08.8-lp151.2.3.1 slurm-hdf5-18.08.8-lp151.2.3.1 slurm-hdf5-debuginfo-18.08.8-lp151.2.3.1 slurm-lua-18.08.8-lp151.2.3.1 slurm-lua-debuginfo-18.08.8-lp151.2.3.1 slurm-munge-18.08.8-lp151.2.3.1 slurm-munge-debuginfo-18.08.8-lp151.2.3.1 slurm-node-18.08.8-lp151.2.3.1 slurm-node-debuginfo-18.08.8-lp151.2.3.1 slurm-openlava-18.08.8-lp151.2.3.1 slurm-pam_slurm-18.08.8-lp151.2.3.1 slurm-pam_slurm-debuginfo-18.08.8-lp151.2.3.1 slurm-plugins-18.08.8-lp151.2.3.1 slurm-plugins-debuginfo-18.08.8-lp151.2.3.1 slurm-seff-18.08.8-lp151.2.3.1 slurm-sjstat-18.08.8-lp151.2.3.1 slurm-slurmdbd-18.08.8-lp151.2.3.1 slurm-slurmdbd-debuginfo-18.08.8-lp151.2.3.1 slurm-sql-18.08.8-lp151.2.3.1 slurm-sql-debuginfo-18.08.8-lp151.2.3.1 slurm-sview-18.08.8-lp151.2.3.1 slurm-sview-debuginfo-18.08.8-lp151.2.3.1 slurm-torque-18.08.8-lp151.2.3.1 slurm-torque-debuginfo-18.08.8-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-12838.html https://bugzilla.suse.com/1140709 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2051-1: important: Security update for apache2
by opensuse-security＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2051-1 Rating: important References: #1145575 #1145738 #1145739 #1145740 #1145741 #1145742 Cross-References: CVE-2019-10081 CVE-2019-10082 CVE-2019-10092 CVE-2019-10097 CVE-2019-10098 CVE-2019-9517 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for apache2 fixes the following issues: Security issues fixed: - CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1145575). - CVE-2019-10081: Fixed mod_http2 that is vulnerable to memory corruption on early pushes (bsc#1145742). - CVE-2019-10082: Fixed mod_http2 that is vulnerable to read-after-free in h2 connection shutdown (bsc#1145741). - CVE-2019-10092: Fixed limited cross-site scripting in mod_proxy (bsc#1145740). - CVE-2019-10097: Fixed mod_remoteip stack buffer overflow and NULL pointer dereference (bsc#1145739). - CVE-2019-10098: Fixed mod_rewrite configuration vulnerablility to open redirect (bsc#1145738). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2051=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2051=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): apache2-2.4.33-lp151.8.6.1 apache2-debuginfo-2.4.33-lp151.8.6.1 apache2-debugsource-2.4.33-lp151.8.6.1 apache2-devel-2.4.33-lp151.8.6.1 apache2-event-2.4.33-lp151.8.6.1 apache2-event-debuginfo-2.4.33-lp151.8.6.1 apache2-example-pages-2.4.33-lp151.8.6.1 apache2-prefork-2.4.33-lp151.8.6.1 apache2-prefork-debuginfo-2.4.33-lp151.8.6.1 apache2-utils-2.4.33-lp151.8.6.1 apache2-utils-debuginfo-2.4.33-lp151.8.6.1 apache2-worker-2.4.33-lp151.8.6.1 apache2-worker-debuginfo-2.4.33-lp151.8.6.1 - openSUSE Leap 15.1 (noarch): apache2-doc-2.4.33-lp151.8.6.1 - openSUSE Leap 15.0 (i586 x86_64): apache2-2.4.33-lp150.2.23.1 apache2-debuginfo-2.4.33-lp150.2.23.1 apache2-debugsource-2.4.33-lp150.2.23.1 apache2-devel-2.4.33-lp150.2.23.1 apache2-event-2.4.33-lp150.2.23.1 apache2-event-debuginfo-2.4.33-lp150.2.23.1 apache2-example-pages-2.4.33-lp150.2.23.1 apache2-prefork-2.4.33-lp150.2.23.1 apache2-prefork-debuginfo-2.4.33-lp150.2.23.1 apache2-utils-2.4.33-lp150.2.23.1 apache2-utils-debuginfo-2.4.33-lp150.2.23.1 apache2-worker-2.4.33-lp150.2.23.1 apache2-worker-debuginfo-2.4.33-lp150.2.23.1 - openSUSE Leap 15.0 (noarch): apache2-doc-2.4.33-lp150.2.23.1 References: https://www.suse.com/security/cve/CVE-2019-10081.html https://www.suse.com/security/cve/CVE-2019-10082.html https://www.suse.com/security/cve/CVE-2019-10092.html https://www.suse.com/security/cve/CVE-2019-10097.html https://www.suse.com/security/cve/CVE-2019-10098.html https://www.suse.com/security/cve/CVE-2019-9517.html https://bugzilla.suse.com/1145575 https://bugzilla.suse.com/1145738 https://bugzilla.suse.com/1145739 https://bugzilla.suse.com/1145740 https://bugzilla.suse.com/1145741 https://bugzilla.suse.com/1145742 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2050-1: moderate: Security update for httpie
by opensuse-security＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Security Update: Security update for httpie ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2050-1 Rating: moderate References: #1148466 Cross-References: CVE-2019-10751 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for httpie fixes the following issues: httpie was updated to version 1.0.3: * Fix CVE-2019-10751 (HTTPie is volnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control. (bsc#1148466) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2050=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2050=1 Package List: - openSUSE Leap 15.1 (noarch): python3-httpie-1.0.3-lp151.2.3.1 - openSUSE Backports SLE-15-SP1 (noarch): python3-httpie-1.0.3-bp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-10751.html https://bugzilla.suse.com/1148466 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2056-1: moderate: Security update for go1.12
by opensuse-security＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Security Update: Security update for go1.12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2056-1 Rating: moderate References: #1139210 #1141689 #1146111 #1146115 #1146123 Cross-References: CVE-2019-14809 CVE-2019-9512 CVE-2019-9514 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for go1.12 fixes the following issues: Security issues fixed: - CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115). - CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123). Bugfixes: - Update to go version 1.12.9 (bsc#1141689). - Adding Web Assembly stuff from misc/wasm (bsc#1139210). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2056=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2056=1 Package List: - openSUSE Leap 15.1 (x86_64): go1.12-1.12.9-lp151.2.13.1 go1.12-doc-1.12.9-lp151.2.13.1 go1.12-race-1.12.9-lp151.2.13.1 - openSUSE Leap 15.0 (x86_64): go1.12-1.12.9-lp150.8.1 go1.12-doc-1.12.9-lp150.8.1 go1.12-race-1.12.9-lp150.8.1 References: https://www.suse.com/security/cve/CVE-2019-14809.html https://www.suse.com/security/cve/CVE-2019-9512.html https://www.suse.com/security/cve/CVE-2019-9514.html https://bugzilla.suse.com/1139210 https://bugzilla.suse.com/1141689 https://bugzilla.suse.com/1146111 https://bugzilla.suse.com/1146115 https://bugzilla.suse.com/1146123 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2044-1: moderate: Security update for podman, slirp4netns and libcontainers-common
by opensuse-security＠opensuse.org 01 Sep '19

01 Sep '19

openSUSE Security Update: Security update for podman, slirp4netns and libcontainers-common ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2044-1 Rating: moderate References: #1096726 #1123156 #1123387 #1135460 #1136974 #1137860 #1143386 Cross-References: CVE-2018-15664 CVE-2019-10152 CVE-2019-6778 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has four fixes is now available. Description: This is a version update for podman to version 1.4.4 (bsc#1143386). Additional changes by SUSE on top: - Remove fuse-overlayfs because it's (currently) an unsatisfied dependency on SLE (bsc#1143386) - Update libpod.conf to use correct infra_command - Update libpod.conf to use better versioned pause container - Update libpod.conf to use official kubic pause container - Update libpod.conf to match latest features set: detach_keys, lock_type, runtime_supports_json - Add podman-remote varlink client Version update podman to v1.4.4: - Features - Podman now has greatly improved support for containers using multiple OCI runtimes. Containers now remember if they were created with a different runtime using --runtime and will always use that runtime - The cached and delegated options for volume mounts are now allowed for Docker compatability (#3340) - The podman diff command now supports the --latest flag - Bugfixes - Fixed a bug where rootless Podman would attempt to use the entire root configuration if no rootless configuration was present for the user, breaking rootless Podman for new installations - Fixed a bug where rootless Podman's pause process would block SIGTERM, preventing graceful system shutdown and hanging until the system's init send SIGKILL - Fixed a bug where running Podman as root with sudo -E would not work after running rootless Podman at least once - Fixed a bug where options for tmpfs volumes added with the --tmpfs flag were being ignored - Fixed a bug where images with no layers could not properly be displayed and removed by Podman - Fixed a bug where locks were not properly freed on failure to create a container or pod - Fixed a bug where podman cp on a single file would create a directory at the target and place the file in it (#3384) - Fixed a bug where podman inspect --format '{{.Mounts}}' would print a hexadecimal address instead of a container's mounts - Fixed a bug where rootless Podman would not add an entry to container's /etc/hosts files for their own hostname (#3405) - Fixed a bug where podman ps --sync would segfault (#3411) - Fixed a bug where podman generate kube would produce an invalid ports configuration (#3408) - Misc - Updated containers/storage to v1.12.13 - Podman now performs much better on systems with heavy I/O load - The --cgroup-manager flag to podman now shows the correct default setting in help if the default was overridden by libpod.conf - For backwards compatability, setting --log-driver=json-file in podman run is now supported as an alias for --log-driver=k8s-file. This is considered deprecated, and json-file will be moved to a new implementation in the future ([#3363](https://github.com/containers/libpo\ d/issues/3363)) - Podman's default libpod.conf file now allows the crun OCI runtime to be used if it is installed Update podman to v1.4.2: - Fixed a bug where Podman could not run containers using an older version of Systemd as init - Updated vendored Buildah to v1.9.0 to resolve a critical bug with Dockerfile RUN instructions - The error message for running podman kill on containers that are not running has been improved - Podman remote client can now log to a file if syslog is not available - The podman exec command now sets its error code differently based on whether the container does not exist, and the command in the container does not exist - The podman inspect command on containers now outputs Mounts JSON that matches that of docker inspect, only including user-specified volumes and differentiating bind mounts and named volumes - The podman inspect command now reports the path to a container's OCI spec with the OCIConfigPath key (only included when the container is initialized or running) - The podman run --mount command now supports the bind-nonrecursive option for bind mounts - Fixed a bug where podman play kube would fail to create containers due to an unspecified log driver - Fixed a bug where Podman would fail to build with musl libc - Fixed a bug where rootless Podman using slirp4netns networking in an environment with no nameservers on the host other than localhost would result in nonfunctional networking - Fixed a bug where podman import would not properly set environment variables, discarding their values and retaining only keys - Fixed a bug where Podman would fail to run when built with Apparmor support but run on systems without the Apparmor kernel module loaded - Remote Podman will now default the username it uses to log in to remote systems to the username of the current user - Podman now uses JSON logging with OCI runtimes that support it, allowing for better error reporting - Updated vendored containers/image to v2.0 - Update conmon to v0.3.0 - Support OOM Monitor under cgroup V2 - Add config binary and make target for configuring conmon with a go library for importing values Updated podman to version 1.4.0 (bsc#1137860) and (bsc#1135460) - Podman checkpoint and podman restore commands can now be used to migrate containers between Podman installations on different systems. - The podman cp now supports pause flag. - The remote client now supports a configuration file for pre-configuring connections to remote Podman installations - CVE-2019-10152: Fixed an iproper dereference of symlinks of the the podman cp command which introduced in version 1.1.0 (bsc#1136974). - Fixed a bug where podman commit could improperly set environment variables that contained = characters - Fixed a bug where rootless podman would sometimes fail to start containers with forwarded ports - Fixed a bug where podman version on the remote client could segfault - Fixed a bug where podman container runlabel would use /proc/self/exe instead of the path of the Podman command when printing the command being executed - Fixed a bug where filtering images by label did not work - Fixed a bug where specifying a bing mount or tmpfs mount over an image volume would cause a container to be unable to start - Fixed a bug where podman generate kube did not work with containers with named volumes - Fixed a bug where rootless podman would receive permission denied errors accessing conmon.pid - Fixed a bug where podman cp with a folder specified as target would replace the folder, as opposed to copying into it - Fixed a bug where rootless Podman commands could double-unlock a lock, causing a crash - Fixed a bug where podman incorrectly set tmpcopyup on /dev/ mounts, causing errors when using the Kata containers runtime - Fixed a bug where podman exec would fail on older kernels - Podman commit command is now usable with the Podman remote client - Signature-policy flag has been deprecated - Updated vendored containers/storage and containers/image libraries with numerous bugfixes - Updated vendored Buildah to v1.8.3 - Podman now requires Conmon v0.2.0 - The podman cp command is now aliased as podman container cp - Rootless podman will now default init_path using root Podman's configuration files (/etc/containers/libpod.conf and /usr/share/containers/libpod.conf) if not overridden in the rootless configuration - Added fuse-overlayfs dependency to support overlay based rootless image manipulations - The podman cp command can now read input redirected to STDIN, and output to STDOUT instead of a file, using - instead of an argument. - The podman remote client now displays version information from both the client and server in podman version - The podman unshare command has been added, allowing easy entry into the user namespace set up by rootless Podman (allowing the removal of files created by rootless podman, among other things) - Fixed a bug where Podman containers with the --rm flag were removing created volumes when they were automatically removed - Fixed a bug where container and pod locks were incorrectly marked as released after a system reboot, causing errors on container and pod removal - Fixed a bug where Podman pods could not be removed if any container in the pod encountered an error during removal - Fixed a bug where Podman pods run with the cgroupfs CGroup driver would encounter a race condition during removal, potentially failing to remove the pod CGroup - Fixed a bug where the podman container checkpoint and podman container restore commands were not visible in the remote client - Fixed a bug where podman remote ps --ns would not print the container's namespaces - Fixed a bug where removing stopped containers with healthchecks could cause an error - Fixed a bug where the default libpod.conf file was causing parsing errors - Fixed a bug where pod locks were not being freed when pods were removed, potentially leading to lock exhaustion - Fixed a bug where 'podman run' with SD_NOTIFY set could, on short-running containers, create an inconsistent state rendering the container unusable - The remote Podman client now uses the Varlink bridge to establish remote connections by default - Fixed an issue with apparmor_parser (bsc#1123387) - Update to libpod v1.4.0 (bsc#1137860): - The podman checkpoint and podman restore commands can now be used to migrate containers between Podman installations on different systems - The podman cp command now supports a pause flag to pause containers while copying into them - The remote client now supports a configuration file for pre-configuring connections to remote Podman installations - Fixed CVE-2019-10152 - The podman cp command improperly dereferenced symlinks in host context - Fixed a bug where podman commit could improperly set environment variables that contained = characters - Fixed a bug where rootless Podman would sometimes fail to start containers with forwarded ports - Fixed a bug where podman version on the remote client could segfault - Fixed a bug where podman container runlabel would use /proc/self/exe instead of the path of the Podman command when printing the command being executed - Fixed a bug where filtering images by label did not work - Fixed a bug where specifying a bing mount or tmpfs mount over an image volume would cause a container to be unable to start - Fixed a bug where podman generate kube did not work with containers with named volumes - Fixed a bug where rootless Podman would receive permission denied errors accessing conmon.pid - Fixed a bug where podman cp with a folder specified as target would replace the folder, as opposed to copying into it - Fixed a bug where rootless Podman commands could double-unlock a lock, causing a crash - Fixed a bug where Podman incorrectly set tmpcopyup on /dev/ mounts, causing errors when using the Kata containers runtime - Fixed a bug where podman exec would fail on older kernels - The podman commit command is now usable with the Podman remote client - The --signature-policy flag (used with several image-related commands) has been deprecated - The podman unshare command now defines two environment variables in the spawned shell: CONTAINERS_RUNROOT and CONTAINERS_GRAPHROOT, pointing to temporary and permanent storage for rootless containers - Updated vendored containers/storage and containers/image libraries with numerous bugfixes - Updated vendored Buildah to v1.8.3 - Podman now requires Conmon v0.2.0 - The podman cp command is now aliased as podman container cp - Rootless Podman will now default init_path using root Podman's configuration files (/etc/containers/libpod.conf and /usr/share/containers/libpod.conf) if not overridden in the rootless configuration - Update to image v1.5.1 - Vendor in latest containers/storage - docker/docker_client: Drop redundant Domain(ref.ref) call - pkg/blobinfocache: Split implementations into subpackages - copy: progress bar: show messages on completion - docs: rename manpages to *.5.command - add container-certs.d.md manpage - pkg/docker/config: Bring auth tests from docker/docker_client_test - Don't allocate a sync.Mutex separately Update to storage v1.12.10: - Add function to parse out mount options from graphdriver - Merge the disparate parts of all of the Unix-like lockfiles - Fix unix-but-not-Linux compilation - Return XDG_RUNTIME_DIR as RootlessRuntimeDir if set - Cherry-pick moby/moby #39292 for CVE-2018-15664 fixes - lockfile: add RecursiveLock() API - Update generated files - Fix crash on tesing of aufs code - Let consumers know when Layers and Images came from read-only stores - chown: do not change owner for the mountpoint - locks: correctly mark updates to the layers list - CreateContainer: don't worry about mapping layers unless necessary - docs: fix manpage for containers-storage.conf - docs: sort configuration options alphabetically - docs: document OSTree file deduplication - Add missing options to man page for containers-storage - overlay: use the layer idmapping if present - vfs: prefer layer custom idmappings - layers: propagate down the idmapping settings - Recreate symlink when not found - docs: fix manpage for configuration file - docs: add special handling for manpages in sect 5 - overlay: fix single-lower test - Recreate symlink when not found - overlay: propagate errors from mountProgram - utils: root in a userns uses global conf file - Fix handling of additional stores - Correctly check permissions on rootless directory - Fix possible integer overflow on 32bit builds - Evaluate device path for lvm - lockfile test: make concurrent RW test determinisitc - lockfile test: make concurrent read tests deterministic - drivers.DirCopy: fix filemode detection - storage: move the logic to detect rootless into utils.go - Don't set (struct flock).l_pid - Improve documentation of getLockfile - Rename getLockFile to createLockerForPath, and document it - Add FILES section to containers-storage.5 man page - add digest locks - drivers/copy: add a non-cgo fallback slirp4netns was updated to 0.3.0: - CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu() (bsc#1123156) This update also includes: - fuse3 and fuse-overlayfs to support rootless containers. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2044=1 Package List: - openSUSE Leap 15.1 (x86_64): fuse-overlayfs-0.4.1-lp151.2.1 fuse-overlayfs-debuginfo-0.4.1-lp151.2.1 fuse-overlayfs-debugsource-0.4.1-lp151.2.1 fuse3-3.6.1-lp151.2.1 fuse3-debuginfo-3.6.1-lp151.2.1 fuse3-debugsource-3.6.1-lp151.2.1 fuse3-devel-3.6.1-lp151.2.1 fuse3-doc-3.6.1-lp151.2.1 libfuse3-3-3.6.1-lp151.2.1 libfuse3-3-debuginfo-3.6.1-lp151.2.1 podman-1.4.4-lp151.3.3.1 slirp4netns-0.3.0-lp151.2.3.1 slirp4netns-debuginfo-0.3.0-lp151.2.3.1 slirp4netns-debugsource-0.3.0-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): libcontainers-common-20190401-lp151.2.3.1 podman-cni-config-1.4.4-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-15664.html https://www.suse.com/security/cve/CVE-2019-10152.html https://www.suse.com/security/cve/CVE-2019-6778.html https://bugzilla.suse.com/1096726 https://bugzilla.suse.com/1123156 https://bugzilla.suse.com/1123387 https://bugzilla.suse.com/1135460 https://bugzilla.suse.com/1136974 https://bugzilla.suse.com/1137860 https://bugzilla.suse.com/1143386 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2041-1: important: Security update for qemu
by opensuse-security＠opensuse.org 01 Sep '19

01 Sep '19

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2041-1 Rating: important References: #1128106 #1133031 #1134883 #1135210 #1135902 #1136540 #1136778 #1138534 #1140402 #1143794 #1144087 Cross-References: CVE-2019-12155 CVE-2019-13164 CVE-2019-14378 CVE-2019-5008 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves four vulnerabilities and has 7 fixes is now available. Description: This update for qemu fixes the following issues: Security issues fixed: - CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794). - CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902). - CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402). - CVE-2019-5008: Fix DoS (NULL pointer dereference) in sparc64 virtual machine possible through guest device driver (bsc#1133031). Bug fixes and enhancements: - Upstream tweaked SnowRidge-Server vcpu model to now be simply Snowridge (jsc#SLE-4883) - Add SnowRidge-Server vcpu model (jsc#SLE-4883) - Add in documentation about md-clear feature (bsc#1138534) - Fix SEV issue where older machine type is not processed correctly (bsc#1144087) - Fix case of a bad pointer in Xen PV usb support code (bsc#1128106) - Further refine arch-capabilities handling to help with security and performance in Intel hosts (bsc#1134883, bsc#1135210) (fate#327764) - Add support for one more security/performance related vcpu feature (bsc#1136778) (fate#327796) - Ignore csske for expanding the cpu model (bsc#1136540) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2041=1 Package List: - openSUSE Leap 15.1 (x86_64): qemu-3.1.1-lp151.7.3.3 qemu-arm-3.1.1-lp151.7.3.3 qemu-arm-debuginfo-3.1.1-lp151.7.3.3 qemu-audio-alsa-3.1.1-lp151.7.3.3 qemu-audio-alsa-debuginfo-3.1.1-lp151.7.3.3 qemu-audio-oss-3.1.1-lp151.7.3.3 qemu-audio-oss-debuginfo-3.1.1-lp151.7.3.3 qemu-audio-pa-3.1.1-lp151.7.3.3 qemu-audio-pa-debuginfo-3.1.1-lp151.7.3.3 qemu-audio-sdl-3.1.1-lp151.7.3.3 qemu-audio-sdl-debuginfo-3.1.1-lp151.7.3.3 qemu-block-curl-3.1.1-lp151.7.3.3 qemu-block-curl-debuginfo-3.1.1-lp151.7.3.3 qemu-block-dmg-3.1.1-lp151.7.3.3 qemu-block-dmg-debuginfo-3.1.1-lp151.7.3.3 qemu-block-gluster-3.1.1-lp151.7.3.3 qemu-block-gluster-debuginfo-3.1.1-lp151.7.3.3 qemu-block-iscsi-3.1.1-lp151.7.3.3 qemu-block-iscsi-debuginfo-3.1.1-lp151.7.3.3 qemu-block-nfs-3.1.1-lp151.7.3.3 qemu-block-nfs-debuginfo-3.1.1-lp151.7.3.3 qemu-block-rbd-3.1.1-lp151.7.3.3 qemu-block-rbd-debuginfo-3.1.1-lp151.7.3.3 qemu-block-ssh-3.1.1-lp151.7.3.3 qemu-block-ssh-debuginfo-3.1.1-lp151.7.3.3 qemu-debuginfo-3.1.1-lp151.7.3.3 qemu-debugsource-3.1.1-lp151.7.3.3 qemu-extra-3.1.1-lp151.7.3.3 qemu-extra-debuginfo-3.1.1-lp151.7.3.3 qemu-guest-agent-3.1.1-lp151.7.3.3 qemu-guest-agent-debuginfo-3.1.1-lp151.7.3.3 qemu-ksm-3.1.1-lp151.7.3.3 qemu-kvm-3.1.1-lp151.7.3.3 qemu-lang-3.1.1-lp151.7.3.3 qemu-linux-user-3.1.1-lp151.7.3.2 qemu-linux-user-debuginfo-3.1.1-lp151.7.3.2 qemu-linux-user-debugsource-3.1.1-lp151.7.3.2 qemu-ppc-3.1.1-lp151.7.3.3 qemu-ppc-debuginfo-3.1.1-lp151.7.3.3 qemu-s390-3.1.1-lp151.7.3.3 qemu-s390-debuginfo-3.1.1-lp151.7.3.3 qemu-testsuite-3.1.1-lp151.7.3.3 qemu-tools-3.1.1-lp151.7.3.3 qemu-tools-debuginfo-3.1.1-lp151.7.3.3 qemu-ui-curses-3.1.1-lp151.7.3.3 qemu-ui-curses-debuginfo-3.1.1-lp151.7.3.3 qemu-ui-gtk-3.1.1-lp151.7.3.3 qemu-ui-gtk-debuginfo-3.1.1-lp151.7.3.3 qemu-ui-sdl-3.1.1-lp151.7.3.3 qemu-ui-sdl-debuginfo-3.1.1-lp151.7.3.3 qemu-x86-3.1.1-lp151.7.3.3 qemu-x86-debuginfo-3.1.1-lp151.7.3.3 - openSUSE Leap 15.1 (noarch): qemu-ipxe-1.0.0+-lp151.7.3.3 qemu-seabios-1.12.0-lp151.7.3.3 qemu-sgabios-8-lp151.7.3.3 qemu-vgabios-1.12.0-lp151.7.3.3 References: https://www.suse.com/security/cve/CVE-2019-12155.html https://www.suse.com/security/cve/CVE-2019-13164.html https://www.suse.com/security/cve/CVE-2019-14378.html https://www.suse.com/security/cve/CVE-2019-5008.html https://bugzilla.suse.com/1128106 https://bugzilla.suse.com/1133031 https://bugzilla.suse.com/1134883 https://bugzilla.suse.com/1135210 https://bugzilla.suse.com/1135902 https://bugzilla.suse.com/1136540 https://bugzilla.suse.com/1136778 https://bugzilla.suse.com/1138534 https://bugzilla.suse.com/1140402 https://bugzilla.suse.com/1143794 https://bugzilla.suse.com/1144087 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0