July 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2019:1787-1: moderate: Recommended update for machinery
by maintenance＠opensuse.org 22 Jul '19

22 Jul '19

openSUSE Recommended Update: Recommended update for machinery ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1787-1 Rating: moderate References: #1125785 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for machinery fixes the following issues: machinery was updated to version 1.24.1: * Fix HTML man page * Switch image building support from legacy Kiwi to Kiwi Next Generation * Allow newer json-schema releases than 2.2.5. Newer versions slow down parsing of manifests but newer Ruby versions have issues with old json schema releases. The performance issue is known upstream: (gh#ruby-json-schema/json-schema#261) * Fix machinery helper go version parsing (boo#1125785) * Improve parsing of SSH exceptions (gh#SUSE/machinery#2257) * Allow inspection of old 32-bit systems even when their architecture is reported as i586 or i386 This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1787=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): machinery-1.24.1-bp150.3.3.1 machinery-doc-1.24.1-bp150.3.3.1 References: https://bugzilla.suse.com/1125785

1 0

openSUSE-RU-2019:1786-1: moderate: Recommended update for python-relatorio
by maintenance＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Recommended Update: Recommended update for python-relatorio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1786-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for python-relatorio fixes the following issues: - python-magic added to requirements Update to version 0.8.1: * Add support for Python 3.7 * Escape invalid XML characters * Enforce closing tag to be the same directive as the opening * Use compression for zip file * Write mimetype as first file of the zip file This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1786=1 Package List: - openSUSE Backports SLE-15 (noarch): python2-relatorio-0.8.1-bp150.3.3.1 python3-relatorio-0.8.1-bp150.3.3.1 References:

1 0

openSUSE-SU-2019:1785-1: moderate: Security update for python-Twisted
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for python-Twisted ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1785-1 Rating: moderate References: #1137825 Cross-References: CVE-2019-12387 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Twisted fixes the following issue: Security issue fixed: - CVE-2019-12387: Fixed an improper sanitization of URIs or HTTP which could have allowed attackers to perfrom CRLF attacks (bsc#1137825). This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1785=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): python-Twisted-doc-17.9.0-bp150.4.3.1 python2-Twisted-17.9.0-bp150.4.3.1 python3-Twisted-17.9.0-bp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-12387.html https://bugzilla.suse.com/1137825

1 0

openSUSE-RU-2019:1784-1: moderate: Recommended update for pure-ftpd
by maintenance＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Recommended Update: Recommended update for pure-ftpd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1784-1 Rating: moderate References: #1119187 #1136997 #547578 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for pure-ftpd fixes the following issues: - Add missing run-time dependency on system-user-ftp to ensure that user exits. [boo#1136997] - Add a configuration option that sets the process memory limit used by "ls" for globbing. The value can be specified as optional third argument to "-L" (or LimitRecursion in config file). Because it's optional, the old configuration files will still work without change with new binaries and update will be smooth. This change allows sites that store an extremely large set of files inside a single directory to tune their installation so that the "ls" command in that directory will succeed without exceeding the ftpd process memory limit. [boo#1119187] This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1784=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): pure-ftpd-1.0.47-bp150.3.3.1 References: https://bugzilla.suse.com/1119187 https://bugzilla.suse.com/1136997 https://bugzilla.suse.com/547578

1 0

openSUSE-SU-2019:1782-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1782-1 Rating: important References: #1140868 Cross-References: CVE-2019-11709 CVE-2019-11711 CVE-2019-11712 CVE-2019-11713 CVE-2019-11715 CVE-2019-11717 CVE-2019-11719 CVE-2019-11729 CVE-2019-11730 CVE-2019-9811 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for MozillaFirefox, mozilla-nss fixes the following issues: MozillaFirefox to version ESR 60.8: - CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868). - CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868). - CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868). - CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868). - CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868). - CVE-2019-11715: HTML parsing error can contribute to content XSS (bsc#1140868). - CVE-2019-11717: Caret character improperly escaped in origins (bsc#1140868). - CVE-2019-11719: Out-of-bounds read when importing curve25519 private key (bsc#1140868). - CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin (bsc#1140868). - CVE-2019-11709: Multiple Memory safety bugs fixed (bsc#1140868). mozilla-nss to version 3.44.1: * Added IPSEC IKE support to softoken * Many new FIPS test cases This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1782=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libfreebl3-3.44.1-lp151.2.3.1 libfreebl3-debuginfo-3.44.1-lp151.2.3.1 libfreebl3-hmac-3.44.1-lp151.2.3.1 libsoftokn3-3.44.1-lp151.2.3.1 libsoftokn3-debuginfo-3.44.1-lp151.2.3.1 libsoftokn3-hmac-3.44.1-lp151.2.3.1 mozilla-nss-3.44.1-lp151.2.3.1 mozilla-nss-certs-3.44.1-lp151.2.3.1 mozilla-nss-certs-debuginfo-3.44.1-lp151.2.3.1 mozilla-nss-debuginfo-3.44.1-lp151.2.3.1 mozilla-nss-debugsource-3.44.1-lp151.2.3.1 mozilla-nss-devel-3.44.1-lp151.2.3.1 mozilla-nss-sysinit-3.44.1-lp151.2.3.1 mozilla-nss-sysinit-debuginfo-3.44.1-lp151.2.3.1 mozilla-nss-tools-3.44.1-lp151.2.3.1 mozilla-nss-tools-debuginfo-3.44.1-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): MozillaFirefox-60.8.0-lp151.2.10.1 MozillaFirefox-branding-upstream-60.8.0-lp151.2.10.1 MozillaFirefox-buildsymbols-60.8.0-lp151.2.10.1 MozillaFirefox-debuginfo-60.8.0-lp151.2.10.1 MozillaFirefox-debugsource-60.8.0-lp151.2.10.1 MozillaFirefox-devel-60.8.0-lp151.2.10.1 MozillaFirefox-translations-common-60.8.0-lp151.2.10.1 MozillaFirefox-translations-other-60.8.0-lp151.2.10.1 libfreebl3-32bit-3.44.1-lp151.2.3.1 libfreebl3-32bit-debuginfo-3.44.1-lp151.2.3.1 libfreebl3-hmac-32bit-3.44.1-lp151.2.3.1 libsoftokn3-32bit-3.44.1-lp151.2.3.1 libsoftokn3-32bit-debuginfo-3.44.1-lp151.2.3.1 libsoftokn3-hmac-32bit-3.44.1-lp151.2.3.1 mozilla-nss-32bit-3.44.1-lp151.2.3.1 mozilla-nss-32bit-debuginfo-3.44.1-lp151.2.3.1 mozilla-nss-certs-32bit-3.44.1-lp151.2.3.1 mozilla-nss-certs-32bit-debuginfo-3.44.1-lp151.2.3.1 mozilla-nss-sysinit-32bit-3.44.1-lp151.2.3.1 mozilla-nss-sysinit-32bit-debuginfo-3.44.1-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-11709.html https://www.suse.com/security/cve/CVE-2019-11711.html https://www.suse.com/security/cve/CVE-2019-11712.html https://www.suse.com/security/cve/CVE-2019-11713.html https://www.suse.com/security/cve/CVE-2019-11715.html https://www.suse.com/security/cve/CVE-2019-11717.html https://www.suse.com/security/cve/CVE-2019-11719.html https://www.suse.com/security/cve/CVE-2019-11729.html https://www.suse.com/security/cve/CVE-2019-11730.html https://www.suse.com/security/cve/CVE-2019-9811.html https://bugzilla.suse.com/1140868

1 0

openSUSE-SU-2019:1781-1: important: Security update for bzip2
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for bzip2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1781-1 Rating: important References: #1139083 Cross-References: CVE-2019-12900 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bzip2 fixes the following issues: Security issue fixed: - CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors (bsc#1139083). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1781=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1781=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): bzip2-1.0.6-lp151.5.6.1 bzip2-debuginfo-1.0.6-lp151.5.6.1 bzip2-debugsource-1.0.6-lp151.5.6.1 libbz2-1-1.0.6-lp151.5.6.1 libbz2-1-debuginfo-1.0.6-lp151.5.6.1 libbz2-devel-1.0.6-lp151.5.6.1 - openSUSE Leap 15.1 (x86_64): libbz2-1-32bit-1.0.6-lp151.5.6.1 libbz2-1-32bit-debuginfo-1.0.6-lp151.5.6.1 libbz2-devel-32bit-1.0.6-lp151.5.6.1 - openSUSE Leap 15.1 (noarch): bzip2-doc-1.0.6-lp151.5.6.1 - openSUSE Leap 15.0 (i586 x86_64): bzip2-1.0.6-lp150.4.6.1 bzip2-debuginfo-1.0.6-lp150.4.6.1 bzip2-debugsource-1.0.6-lp150.4.6.1 libbz2-1-1.0.6-lp150.4.6.1 libbz2-1-debuginfo-1.0.6-lp150.4.6.1 libbz2-devel-1.0.6-lp150.4.6.1 - openSUSE Leap 15.0 (x86_64): libbz2-1-32bit-1.0.6-lp150.4.6.1 libbz2-1-32bit-debuginfo-1.0.6-lp150.4.6.1 libbz2-devel-32bit-1.0.6-lp150.4.6.1 - openSUSE Leap 15.0 (noarch): bzip2-doc-1.0.6-lp150.4.6.1 References: https://www.suse.com/security/cve/CVE-2019-12900.html https://bugzilla.suse.com/1139083

1 0

openSUSE-RU-2019:1776-1: moderate: Recommended update for timezone
by maintenance＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1776-1 Rating: moderate References: #1140016 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for timezone fixes the following issues: Timezone database was updated to 2019b. (bsc#1140016): - Brazil no longer observes DST. - 'zic -b slim' outputs smaller TZif files. - Palestine's 2019 spring-forward transition was on 03-29, not 03-30. - Add info about the Crimea situation. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1776=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1776=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): timezone-2019b-lp151.2.3.1 timezone-debuginfo-2019b-lp151.2.3.1 timezone-debugsource-2019b-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): timezone-java-2019b-lp151.2.3.1 - openSUSE Leap 15.0 (i586 x86_64): timezone-2019b-lp150.64.1 timezone-debuginfo-2019b-lp150.64.1 timezone-debugsource-2019b-lp150.64.1 References: https://bugzilla.suse.com/1140016

1 0

openSUSE-SU-2019:1777-1: moderate: Security update for expat
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for expat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1777-1 Rating: moderate References: #1139937 Cross-References: CVE-2018-20843 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for expat fixes the following issues: Security issue fixed: - CVE-2018-20843: Fixed a denial of service triggered by high resource consumption in the XML parser when XML names contain a large amount of colons (bsc#1139937). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1777=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1777=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): expat-2.2.5-lp151.3.3.1 expat-debuginfo-2.2.5-lp151.3.3.1 expat-debugsource-2.2.5-lp151.3.3.1 libexpat-devel-2.2.5-lp151.3.3.1 libexpat1-2.2.5-lp151.3.3.1 libexpat1-debuginfo-2.2.5-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): expat-32bit-debuginfo-2.2.5-lp151.3.3.1 libexpat-devel-32bit-2.2.5-lp151.3.3.1 libexpat1-32bit-2.2.5-lp151.3.3.1 libexpat1-32bit-debuginfo-2.2.5-lp151.3.3.1 - openSUSE Leap 15.0 (i586 x86_64): expat-2.2.5-lp150.2.3.1 expat-debuginfo-2.2.5-lp150.2.3.1 expat-debugsource-2.2.5-lp150.2.3.1 libexpat-devel-2.2.5-lp150.2.3.1 libexpat1-2.2.5-lp150.2.3.1 libexpat1-debuginfo-2.2.5-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): expat-32bit-debuginfo-2.2.5-lp150.2.3.1 libexpat-devel-32bit-2.2.5-lp150.2.3.1 libexpat1-32bit-2.2.5-lp150.2.3.1 libexpat1-32bit-debuginfo-2.2.5-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-20843.html https://bugzilla.suse.com/1139937

1 0

openSUSE-SU-2019:1780-1: moderate: Security update for clementine
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for clementine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1780-1 Rating: moderate References: #1103041 Cross-References: CVE-2018-14332 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for clementine fixes the following issues: - CVE-2018-14332: Fixed a NULL ptr dereference (crash) in the moodbar pipeline (boo#1103041) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1780=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1780=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1780=1 Package List: - openSUSE Leap 15.1 (x86_64): clementine-1.3.1-lp151.3.3.1 clementine-debuginfo-1.3.1-lp151.3.3.1 clementine-debugsource-1.3.1-lp151.3.3.1 - openSUSE Leap 15.0 (x86_64): clementine-1.3.1-lp150.2.3.1 clementine-debuginfo-1.3.1-lp150.2.3.1 clementine-debugsource-1.3.1-lp150.2.3.1 - openSUSE Backports SLE-15 (x86_64): clementine-1.3.1-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-14332.html https://bugzilla.suse.com/1103041

1 0

openSUSE-SU-2019:1775-1: important: Security update for znc
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for znc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1775-1 Rating: important References: #1130360 #1138572 Cross-References: CVE-2019-12816 CVE-2019-9917 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for znc to version 1.7.4 fixes the following issues: Security issues fixed: - CVE-2019-12816: Fixed a remote code execution in Modules.cpp (boo#1138572). - CVE-2019-9917: Fixed a denial of service on invalid encoding (boo#1130360). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1775=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1775=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1775=1 Package List: - openSUSE Leap 15.1 (x86_64): znc-1.7.4-lp151.2.3.1 znc-debuginfo-1.7.4-lp151.2.3.1 znc-debugsource-1.7.4-lp151.2.3.1 znc-devel-1.7.4-lp151.2.3.1 znc-perl-1.7.4-lp151.2.3.1 znc-perl-debuginfo-1.7.4-lp151.2.3.1 znc-python3-1.7.4-lp151.2.3.1 znc-python3-debuginfo-1.7.4-lp151.2.3.1 znc-tcl-1.7.4-lp151.2.3.1 znc-tcl-debuginfo-1.7.4-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): znc-lang-1.7.4-lp151.2.3.1 - openSUSE Leap 15.0 (noarch): znc-lang-1.7.4-lp150.28.1 - openSUSE Leap 15.0 (x86_64): znc-1.7.4-lp150.28.1 znc-debuginfo-1.7.4-lp150.28.1 znc-debugsource-1.7.4-lp150.28.1 znc-devel-1.7.4-lp150.28.1 znc-perl-1.7.4-lp150.28.1 znc-perl-debuginfo-1.7.4-lp150.28.1 znc-python3-1.7.4-lp150.28.1 znc-python3-debuginfo-1.7.4-lp150.28.1 znc-tcl-1.7.4-lp150.28.1 znc-tcl-debuginfo-1.7.4-lp150.28.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): znc-1.7.4-bp150.2.6.1 znc-devel-1.7.4-bp150.2.6.1 znc-perl-1.7.4-bp150.2.6.1 znc-python3-1.7.4-bp150.2.6.1 znc-tcl-1.7.4-bp150.2.6.1 - openSUSE Backports SLE-15 (noarch): znc-lang-1.7.4-bp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-12816.html https://www.suse.com/security/cve/CVE-2019-9917.html https://bugzilla.suse.com/1130360 https://bugzilla.suse.com/1138572

1 0