October 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2019:2387-1: moderate: Recommended update for tcsh
by maintenance＠opensuse.org 27 Oct '19

27 Oct '19

openSUSE Recommended Update: Recommended update for tcsh ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2387-1 Rating: moderate References: #1151630 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tcsh fixes the following issues: - Restore cleanup routines in case of an error (bsc#1151630) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2387=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): tcsh-6.20.00-lp151.3.6.1 tcsh-debuginfo-6.20.00-lp151.3.6.1 tcsh-debugsource-6.20.00-lp151.3.6.1 - openSUSE Leap 15.1 (noarch): tcsh-lang-6.20.00-lp151.3.6.1 References: https://bugzilla.suse.com/1151630

1 0

openSUSE-RU-2019:2386-1: moderate: Recommended update for postfix
by maintenance＠opensuse.org 27 Oct '19

27 Oct '19

openSUSE Recommended Update: Recommended update for postfix ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2386-1 Rating: moderate References: #1142881 #1149724 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for postfix fixes the following issues: - Fixed build on Linux kernel 5.x by handling LINUX5 define (bsc#1149724) - Switch from md5 to sha256 for mkpostfixcert (bsc#1142881) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2386=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): postfix-3.3.1-lp151.2.9.1 postfix-debuginfo-3.3.1-lp151.2.9.1 postfix-debugsource-3.3.1-lp151.2.9.1 postfix-devel-3.3.1-lp151.2.9.1 postfix-lmdb-3.3.1-lp151.2.9.1 postfix-lmdb-debuginfo-3.3.1-lp151.2.9.1 postfix-mysql-3.3.1-lp151.2.9.1 postfix-mysql-debuginfo-3.3.1-lp151.2.9.1 postfix-postgresql-3.3.1-lp151.2.9.1 postfix-postgresql-debuginfo-3.3.1-lp151.2.9.1 - openSUSE Leap 15.1 (noarch): postfix-doc-3.3.1-lp151.2.9.1 References: https://bugzilla.suse.com/1142881 https://bugzilla.suse.com/1149724

1 0

openSUSE-RU-2019:2382-1: moderate: Recommended update for yast2-security
by maintenance＠opensuse.org 27 Oct '19

27 Oct '19

openSUSE Recommended Update: Recommended update for yast2-security ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2382-1 Rating: moderate References: #1147173 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-security fixes the following issues: - Supporting user defined permission files like "/etc/permissions.ultra". (bsc#1147173) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2382=1 Package List: - openSUSE Leap 15.0 (noarch): yast2-security-4.0.2-lp150.10.1 References: https://bugzilla.suse.com/1147173

1 0

openSUSE-SU-2019:2385-1: moderate: Security update for openconnect
by opensuse-security＠opensuse.org 27 Oct '19

27 Oct '19

openSUSE Security Update: Security update for openconnect ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2385-1 Rating: moderate References: #1151178 Cross-References: CVE-2019-16239 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openconnect fixes the following issues: - CVE-2019-16239: Fixed a buffer overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes. (bsc#1151178) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2385=1 Package List: - openSUSE Leap 15.1 (noarch): openconnect-lang-7.08-lp151.6.3.1 - openSUSE Leap 15.1 (x86_64): openconnect-7.08-lp151.6.3.1 openconnect-debuginfo-7.08-lp151.6.3.1 openconnect-debugsource-7.08-lp151.6.3.1 openconnect-devel-7.08-lp151.6.3.1 openconnect-doc-7.08-lp151.6.3.1 References: https://www.suse.com/security/cve/CVE-2019-16239.html https://bugzilla.suse.com/1151178

1 0

openSUSE-RU-2019:2380-1: moderate: Recommended update for pciutils-ids
by maintenance＠opensuse.org 27 Oct '19

27 Oct '19

openSUSE Recommended Update: Recommended update for pciutils-ids ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2380-1 Rating: moderate References: #1127840 #1133581 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This is a version update for pciutils-ids to version 20190830 (bsc#1133581, bsc#1127840) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2380=1 Package List: - openSUSE Leap 15.0 (noarch): pciutils-ids-20190830-lp150.2.3.1 References: https://bugzilla.suse.com/1127840 https://bugzilla.suse.com/1133581

1 0

openSUSE-RU-2019:2381-1: moderate: Recommended update for yast2-security
by maintenance＠opensuse.org 27 Oct '19

27 Oct '19

openSUSE Recommended Update: Recommended update for yast2-security ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2381-1 Rating: moderate References: #1147173 #1150821 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-security provides the following fixes: - Support user defined permission files like "/etc/permissions.ultra". (bsc#1147173) - Fix a problem that was causing Autoyast to not export security settings. The "console_shutdown" entry was not been evaluated. (bsc#1150821) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2381=1 Package List: - openSUSE Leap 15.1 (noarch): yast2-security-4.1.4-lp151.2.3.1 References: https://bugzilla.suse.com/1147173 https://bugzilla.suse.com/1150821

1 0

openSUSE-SU-2019:2379-1: important: Security update for procps
by opensuse-security＠opensuse.org 26 Oct '19

26 Oct '19

openSUSE Security Update: Security update for procps ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2379-1 Rating: important References: #1092100 #1121753 Cross-References: CVE-2018-1122 CVE-2018-1123 CVE-2018-1124 CVE-2018-1125 CVE-2018-1126 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for procps fixes the following issues: procps was updated to 3.3.15. (bsc#1092100) Following security issues were fixed: - CVE-2018-1122: Prevent local privilege escalation in top. If a user ran top with HOME unset in an attacker-controlled directory, the attacker could have achieved privilege escalation by exploiting one of several vulnerabilities in the config_file() function (bsc#1092100). - CVE-2018-1123: Prevent denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maped a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service) (bsc#1092100). - CVE-2018-1124: Prevent multiple integer overflows leading to a heap corruption in file2strvec function. This allowed a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users (bsc#1092100). - CVE-2018-1125: Prevent stack buffer overflow in pgrep. This vulnerability was mitigated by FORTIFY limiting the impact to a crash (bsc#1092100). - CVE-2018-1126: Ensure correct integer size in proc/alloc.* to prevent truncation/integer overflow issues (bsc#1092100). Also this non-security issue was fixed: - Fix CPU summary showing old data. (bsc#1121753) The update to 3.3.15 contains the following fixes: * library: Increment to 8:0:1 No removals, no new functions Changes: slab and pid structures * library: Just check for SIGLOST and don't delete it * library: Fix integer overflow and LPE in file2strvec CVE-2018-1124 * library: Use size_t for alloc functions CVE-2018-1126 * library: Increase comm size to 64 * pgrep: Fix stack-based buffer overflow CVE-2018-1125 * pgrep: Remove >15 warning as comm can be longer * ps: Fix buffer overflow in output buffer, causing DOS CVE-2018-1123 * ps: Increase command name selection field to 64 * top: Don't use cwd for location of config CVE-2018-1122 * update translations * library: build on non-glibc systems * free: fix scaling on 32-bit systems * Revert "Support running with child namespaces" * library: Increment to 7:0:1 No changes, no removals New fuctions: numa_init, numa_max_node, numa_node_of_cpu, numa_uninit, xalloc_err_handler * doc: Document I idle state in ps.1 and top.1 * free: fix some of the SI multiples * kill: -l space between name parses correctly * library: dont use vm_min_free on non Linux * library: don't strip off wchan prefixes (ps & top) * pgrep: warn about 15+ char name only if -f not used * pgrep/pkill: only match in same namespace by default * pidof: specify separator between pids * pkill: Return 0 only if we can kill process * pmap: fix duplicate output line under '-x' option * ps: avoid eip/esp address truncations * ps: recognizes SCHED_DEADLINE as valid CPU scheduler * ps: display NUMA node under which a thread ran * ps: Add seconds display for cputime and time * ps: Add LUID field * sysctl: Permit empty string for value * sysctl: Don't segv when file not available * sysctl: Read and write large buffers * top: add config file support for XDG specification * top: eliminated minor libnuma memory leak * top: show fewer memory decimal places (configurable) * top: provide command line switch for memory scaling * top: provide command line switch for CPU States * top: provides more accurate cpu usage at startup * top: display NUMA node under which a thread ran * top: fix argument parsing quirk resulting in SEGV * top: delay interval accepts non-locale radix point * top: address a wishlist man page NLS suggestion * top: fix potential distortion in 'Mem' graph display * top: provide proper multi-byte string handling * top: startup defaults are fully customizable * watch: define HOST_NAME_MAX where not defined * vmstat: Fix alignment for disk partition format * watch: Support ANSI 39,49 reset sequences This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2379=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libprocps7-3.3.15-lp150.5.3.1 libprocps7-debuginfo-3.3.15-lp150.5.3.1 procps-3.3.15-lp150.5.3.1 procps-debuginfo-3.3.15-lp150.5.3.1 procps-debugsource-3.3.15-lp150.5.3.1 procps-devel-3.3.15-lp150.5.3.1 References: https://www.suse.com/security/cve/CVE-2018-1122.html https://www.suse.com/security/cve/CVE-2018-1123.html https://www.suse.com/security/cve/CVE-2018-1124.html https://www.suse.com/security/cve/CVE-2018-1125.html https://www.suse.com/security/cve/CVE-2018-1126.html https://bugzilla.suse.com/1092100 https://bugzilla.suse.com/1121753

1 0

openSUSE-RU-2019:2378-1: moderate: Recommended update for cifs-utils
by maintenance＠opensuse.org 26 Oct '19

26 Oct '19

openSUSE Recommended Update: Recommended update for cifs-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2378-1 Rating: moderate References: #1130528 #1132087 #1136031 #1149164 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for cifs-utils fixes the following issues: Update cifs-utils 6.9; (bsc#1132087); (bsc#1136031). * follow SMB default version changes in the kernel. * adds fixes for Azure * new smbinfo utility - Fix double-free in mount.cifs; (bsc#1149164). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2378=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): cifs-utils-6.9-lp150.2.6.1 cifs-utils-debuginfo-6.9-lp150.2.6.1 cifs-utils-debugsource-6.9-lp150.2.6.1 cifs-utils-devel-6.9-lp150.2.6.1 pam_cifscreds-6.9-lp150.2.6.1 pam_cifscreds-debuginfo-6.9-lp150.2.6.1 References: https://bugzilla.suse.com/1130528 https://bugzilla.suse.com/1132087 https://bugzilla.suse.com/1136031 https://bugzilla.suse.com/1149164

1 0

openSUSE-RU-2019:2377-1: moderate: Recommended update for yast2-services-manager
by maintenance＠opensuse.org 26 Oct '19

26 Oct '19

openSUSE Recommended Update: Recommended update for yast2-services-manager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2377-1 Rating: moderate References: #1140735 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-services-manager fixes the following issues: - Set BaseTargets::GRAPHICAL and Target::GRAPHICAL if package "xdm" will be installed (instead of xorg-x11-server). (bsc#1140735) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2377=1 Package List: - openSUSE Leap 15.1 (noarch): yast2-services-manager-4.1.15-lp151.2.3.1 References: https://bugzilla.suse.com/1140735

1 0

openSUSE-SU-2019:2376-1: important: Security update for procps
by opensuse-security＠opensuse.org 26 Oct '19

26 Oct '19

openSUSE Security Update: Security update for procps ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2376-1 Rating: important References: #1092100 #1121753 Cross-References: CVE-2018-1122 CVE-2018-1123 CVE-2018-1124 CVE-2018-1125 CVE-2018-1126 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for procps fixes the following issues: procps was updated to 3.3.15. (bsc#1092100) Following security issues were fixed: - CVE-2018-1122: Prevent local privilege escalation in top. If a user ran top with HOME unset in an attacker-controlled directory, the attacker could have achieved privilege escalation by exploiting one of several vulnerabilities in the config_file() function (bsc#1092100). - CVE-2018-1123: Prevent denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maped a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service) (bsc#1092100). - CVE-2018-1124: Prevent multiple integer overflows leading to a heap corruption in file2strvec function. This allowed a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users (bsc#1092100). - CVE-2018-1125: Prevent stack buffer overflow in pgrep. This vulnerability was mitigated by FORTIFY limiting the impact to a crash (bsc#1092100). - CVE-2018-1126: Ensure correct integer size in proc/alloc.* to prevent truncation/integer overflow issues (bsc#1092100). Also this non-security issue was fixed: - Fix CPU summary showing old data. (bsc#1121753) The update to 3.3.15 contains the following fixes: * library: Increment to 8:0:1 No removals, no new functions Changes: slab and pid structures * library: Just check for SIGLOST and don't delete it * library: Fix integer overflow and LPE in file2strvec CVE-2018-1124 * library: Use size_t for alloc functions CVE-2018-1126 * library: Increase comm size to 64 * pgrep: Fix stack-based buffer overflow CVE-2018-1125 * pgrep: Remove >15 warning as comm can be longer * ps: Fix buffer overflow in output buffer, causing DOS CVE-2018-1123 * ps: Increase command name selection field to 64 * top: Don't use cwd for location of config CVE-2018-1122 * update translations * library: build on non-glibc systems * free: fix scaling on 32-bit systems * Revert "Support running with child namespaces" * library: Increment to 7:0:1 No changes, no removals New fuctions: numa_init, numa_max_node, numa_node_of_cpu, numa_uninit, xalloc_err_handler * doc: Document I idle state in ps.1 and top.1 * free: fix some of the SI multiples * kill: -l space between name parses correctly * library: dont use vm_min_free on non Linux * library: don't strip off wchan prefixes (ps & top) * pgrep: warn about 15+ char name only if -f not used * pgrep/pkill: only match in same namespace by default * pidof: specify separator between pids * pkill: Return 0 only if we can kill process * pmap: fix duplicate output line under '-x' option * ps: avoid eip/esp address truncations * ps: recognizes SCHED_DEADLINE as valid CPU scheduler * ps: display NUMA node under which a thread ran * ps: Add seconds display for cputime and time * ps: Add LUID field * sysctl: Permit empty string for value * sysctl: Don't segv when file not available * sysctl: Read and write large buffers * top: add config file support for XDG specification * top: eliminated minor libnuma memory leak * top: show fewer memory decimal places (configurable) * top: provide command line switch for memory scaling * top: provide command line switch for CPU States * top: provides more accurate cpu usage at startup * top: display NUMA node under which a thread ran * top: fix argument parsing quirk resulting in SEGV * top: delay interval accepts non-locale radix point * top: address a wishlist man page NLS suggestion * top: fix potential distortion in 'Mem' graph display * top: provide proper multi-byte string handling * top: startup defaults are fully customizable * watch: define HOST_NAME_MAX where not defined * vmstat: Fix alignment for disk partition format * watch: Support ANSI 39,49 reset sequences This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2376=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libprocps7-3.3.15-lp151.6.3.1 libprocps7-debuginfo-3.3.15-lp151.6.3.1 procps-3.3.15-lp151.6.3.1 procps-debuginfo-3.3.15-lp151.6.3.1 procps-debugsource-3.3.15-lp151.6.3.1 procps-devel-3.3.15-lp151.6.3.1 References: https://www.suse.com/security/cve/CVE-2018-1122.html https://www.suse.com/security/cve/CVE-2018-1123.html https://www.suse.com/security/cve/CVE-2018-1124.html https://www.suse.com/security/cve/CVE-2018-1125.html https://www.suse.com/security/cve/CVE-2018-1126.html https://bugzilla.suse.com/1092100 https://bugzilla.suse.com/1121753

1 0