July 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:1771-1: important: Security update for ruby-bundled-gems-rpmhelper, ruby2.5
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for ruby-bundled-gems-rpmhelper, ruby2.5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1771-1 Rating: important References: #1082007 #1082008 #1082009 #1082010 #1082011 #1082014 #1082058 #1087433 #1087434 #1087436 #1087437 #1087440 #1087441 #1112530 #1112532 #1130028 #1130611 #1130617 #1130620 #1130622 #1130623 #1130627 #1133790 Cross-References: CVE-2017-17742 CVE-2018-1000073 CVE-2018-1000074 CVE-2018-1000075 CVE-2018-1000076 CVE-2018-1000077 CVE-2018-1000078 CVE-2018-1000079 CVE-2018-16395 CVE-2018-16396 CVE-2018-6914 CVE-2018-8777 CVE-2018-8778 CVE-2018-8779 CVE-2018-8780 CVE-2019-8320 CVE-2019-8321 CVE-2019-8322 CVE-2019-8323 CVE-2019-8324 CVE-2019-8325 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 21 vulnerabilities and has two fixes is now available. Description: This update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the following issues: Changes in ruby2.5: Update to 2.5.5 and 2.5.4: https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/ https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/ Security issues fixed: - CVE-2019-8320: Delete directory using symlink when decompressing tar (bsc#1130627) - CVE-2019-8321: Escape sequence injection vulnerability in verbose (bsc#1130623) - CVE-2019-8322: Escape sequence injection vulnerability in gem owner (bsc#1130622) - CVE-2019-8323: Escape sequence injection vulnerability in API response handling (bsc#1130620) - CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution (bsc#1130617) - CVE-2019-8325: Escape sequence injection vulnerability in errors (bsc#1130611) Ruby 2.5 was updated to 2.5.3: This release includes some bug fixes and some security fixes. Security issues fixed: - CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives (bsc#1112532) - CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly (bsc#1112530) Ruby 2.5 was updated to 2.5.1: This release includes some bug fixes and some security fixes. Security issues fixed: - CVE-2017-17742: HTTP response splitting in WEBrick (bsc#1087434) - CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (bsc#1087441) - CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436) - CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433) - CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket (bsc#1087440) - CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in Dir (bsc#1087437) - Multiple vulnerabilities in RubyGems were fixed: - CVE-2018-1000079: Fixed path traversal issue during gem installation allows to write to arbitrary filesystem locations (bsc#1082058) - CVE-2018-1000075: Fixed infinite loop vulnerability due to negative size in tar header causes Denial of Service (bsc#1082014) - CVE-2018-1000078: Fixed XSS vulnerability in homepage attribute when displayed via gem server (bsc#1082011) - CVE-2018-1000077: Fixed that missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (bsc#1082010) - CVE-2018-1000076: Fixed improper verification of signatures in tarball allows to install mis-signed gem (bsc#1082009) - CVE-2018-1000074: Fixed unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (bsc#1082008) - CVE-2018-1000073: Fixed path traversal when writing to a symlinked basedir outside of the root (bsc#1082007) Other changes: - Fixed Net::POPMail methods modify frozen literal when using default arg - ruby: change over of the Japanese Era to the new emperor May 1st 2019 (bsc#1133790) - build with PIE support (bsc#1130028) Changes in ruby-bundled-gems-rpmhelper: - Add a new helper for bundled ruby gems. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1771=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1771=1 Package List: - openSUSE Leap 15.1 (noarch): ruby-bundled-gems-rpmhelper-0.0.2-lp151.2.1 ruby2.5-doc-ri-2.5.5-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): libruby2_5-2_5-2.5.5-lp151.4.3.1 libruby2_5-2_5-debuginfo-2.5.5-lp151.4.3.1 ruby2.5-2.5.5-lp151.4.3.1 ruby2.5-debuginfo-2.5.5-lp151.4.3.1 ruby2.5-debugsource-2.5.5-lp151.4.3.1 ruby2.5-devel-2.5.5-lp151.4.3.1 ruby2.5-devel-extra-2.5.5-lp151.4.3.1 ruby2.5-doc-2.5.5-lp151.4.3.1 ruby2.5-stdlib-2.5.5-lp151.4.3.1 ruby2.5-stdlib-debuginfo-2.5.5-lp151.4.3.1 - openSUSE Leap 15.0 (noarch): ruby-bundled-gems-rpmhelper-0.0.2-lp150.2.1 ruby2.5-doc-ri-2.5.5-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): libruby2_5-2_5-2.5.5-lp150.3.3.1 libruby2_5-2_5-debuginfo-2.5.5-lp150.3.3.1 ruby2.5-2.5.5-lp150.3.3.1 ruby2.5-debuginfo-2.5.5-lp150.3.3.1 ruby2.5-debugsource-2.5.5-lp150.3.3.1 ruby2.5-devel-2.5.5-lp150.3.3.1 ruby2.5-devel-extra-2.5.5-lp150.3.3.1 ruby2.5-doc-2.5.5-lp150.3.3.1 ruby2.5-stdlib-2.5.5-lp150.3.3.1 ruby2.5-stdlib-debuginfo-2.5.5-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2017-17742.html https://www.suse.com/security/cve/CVE-2018-1000073.html https://www.suse.com/security/cve/CVE-2018-1000074.html https://www.suse.com/security/cve/CVE-2018-1000075.html https://www.suse.com/security/cve/CVE-2018-1000076.html https://www.suse.com/security/cve/CVE-2018-1000077.html https://www.suse.com/security/cve/CVE-2018-1000078.html https://www.suse.com/security/cve/CVE-2018-1000079.html https://www.suse.com/security/cve/CVE-2018-16395.html https://www.suse.com/security/cve/CVE-2018-16396.html https://www.suse.com/security/cve/CVE-2018-6914.html https://www.suse.com/security/cve/CVE-2018-8777.html https://www.suse.com/security/cve/CVE-2018-8778.html https://www.suse.com/security/cve/CVE-2018-8779.html https://www.suse.com/security/cve/CVE-2018-8780.html https://www.suse.com/security/cve/CVE-2019-8320.html https://www.suse.com/security/cve/CVE-2019-8321.html https://www.suse.com/security/cve/CVE-2019-8322.html https://www.suse.com/security/cve/CVE-2019-8323.html https://www.suse.com/security/cve/CVE-2019-8324.html https://www.suse.com/security/cve/CVE-2019-8325.html https://bugzilla.suse.com/1082007 https://bugzilla.suse.com/1082008 https://bugzilla.suse.com/1082009 https://bugzilla.suse.com/1082010 https://bugzilla.suse.com/1082011 https://bugzilla.suse.com/1082014 https://bugzilla.suse.com/1082058 https://bugzilla.suse.com/1087433 https://bugzilla.suse.com/1087434 https://bugzilla.suse.com/1087436 https://bugzilla.suse.com/1087437 https://bugzilla.suse.com/1087440 https://bugzilla.suse.com/1087441 https://bugzilla.suse.com/1112530 https://bugzilla.suse.com/1112532 https://bugzilla.suse.com/1130028 https://bugzilla.suse.com/1130611 https://bugzilla.suse.com/1130617 https://bugzilla.suse.com/1130620 https://bugzilla.suse.com/1130622 https://bugzilla.suse.com/1130623 https://bugzilla.suse.com/1130627 https://bugzilla.suse.com/1133790

1 0

openSUSE-RU-2019:1772-1: moderate: Recommended update for java-11-openjdk
by maintenance＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Recommended Update: Recommended update for java-11-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1772-1 Rating: moderate References: #1137264 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update ships the OpenJDK LTS version 11 in the java-11-openjdk packages. (FATE#326347 bsc#1137264) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1772=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1772=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): java-11-openjdk-11.0.3.0-lp151.3.3.1 java-11-openjdk-accessibility-11.0.3.0-lp151.3.3.1 java-11-openjdk-accessibility-debuginfo-11.0.3.0-lp151.3.3.1 java-11-openjdk-debuginfo-11.0.3.0-lp151.3.3.1 java-11-openjdk-debugsource-11.0.3.0-lp151.3.3.1 java-11-openjdk-demo-11.0.3.0-lp151.3.3.1 java-11-openjdk-devel-11.0.3.0-lp151.3.3.1 java-11-openjdk-headless-11.0.3.0-lp151.3.3.1 java-11-openjdk-jmods-11.0.3.0-lp151.3.3.1 java-11-openjdk-src-11.0.3.0-lp151.3.3.1 - openSUSE Leap 15.1 (noarch): java-11-openjdk-javadoc-11.0.3.0-lp151.3.3.1 - openSUSE Leap 15.0 (noarch): java-11-openjdk-javadoc-11.0.3.0-lp150.2.22.1 - openSUSE Leap 15.0 (x86_64): java-11-openjdk-11.0.3.0-lp150.2.22.1 java-11-openjdk-accessibility-11.0.3.0-lp150.2.22.1 java-11-openjdk-accessibility-debuginfo-11.0.3.0-lp150.2.22.1 java-11-openjdk-debuginfo-11.0.3.0-lp150.2.22.1 java-11-openjdk-debugsource-11.0.3.0-lp150.2.22.1 java-11-openjdk-demo-11.0.3.0-lp150.2.22.1 java-11-openjdk-devel-11.0.3.0-lp150.2.22.1 java-11-openjdk-headless-11.0.3.0-lp150.2.22.1 java-11-openjdk-jmods-11.0.3.0-lp150.2.22.1 java-11-openjdk-src-11.0.3.0-lp150.2.22.1 References: https://bugzilla.suse.com/1137264

1 0

openSUSE-RU-2019:1774-1: moderate: Recommended update for pure-ftpd
by maintenance＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Recommended Update: Recommended update for pure-ftpd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1774-1 Rating: moderate References: #1119187 #1136997 #547578 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for pure-ftpd fixes the following issues: - Add missing run-time dependency on system-user-ftp to ensure that user exits. [boo#1136997] - Add a configuration option that sets the process memory limit used by "ls" for globbing. The value can be specified as optional third argument to "-L" (or LimitRecursion in config file). Because it's optional, the old configuration files will still work without change with new binaries and update will be smooth. This change allows sites that store an extremely large set of files inside a single directory to tune their installation so that the "ls" command in that directory will succeed without exceeding the ftpd process memory limit. [boo#1119187] Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1774=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1774=1 Package List: - openSUSE Leap 15.1 (x86_64): pure-ftpd-1.0.47-lp151.5.3.1 pure-ftpd-debuginfo-1.0.47-lp151.5.3.1 pure-ftpd-debugsource-1.0.47-lp151.5.3.1 - openSUSE Leap 15.0 (x86_64): pure-ftpd-1.0.47-lp150.2.3.1 pure-ftpd-debuginfo-1.0.47-lp150.2.3.1 pure-ftpd-debugsource-1.0.47-lp150.2.3.1 References: https://bugzilla.suse.com/1119187 https://bugzilla.suse.com/1136997 https://bugzilla.suse.com/547578

1 0

openSUSE-SU-2019:1773-1: moderate: Security update for postgresql10
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for postgresql10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1773-1 Rating: moderate References: #1134689 #1138034 Cross-References: CVE-2019-10130 CVE-2019-10164 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for postgresql10 fixes the following issues: Security issue fixed: - CVE-2019-10164: Fixed buffer-overflow vulnerabilities in SCRAM verifier parsing (bsc#1138034). - CVE-2019-10130: Prevent row-level security policies from being bypassed via selectivity estimators (bsc#1134689). Bug fixes: - For a complete list of fixes check the release notes. * https://www.postgresql.org/docs/10/release-10-9.html * https://www.postgresql.org/docs/10/release-10-8.html * https://www.postgresql.org/docs/10/release-10-7.html This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1773=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1773=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libecpg6-10.9-lp151.2.3.1 libecpg6-debuginfo-10.9-lp151.2.3.1 libpq5-10.9-lp151.2.3.1 libpq5-debuginfo-10.9-lp151.2.3.1 postgresql10-10.9-lp151.2.3.1 postgresql10-contrib-10.9-lp151.2.3.1 postgresql10-contrib-debuginfo-10.9-lp151.2.3.1 postgresql10-debuginfo-10.9-lp151.2.3.1 postgresql10-debugsource-10.9-lp151.2.3.1 postgresql10-devel-10.9-lp151.2.3.1 postgresql10-devel-debuginfo-10.9-lp151.2.3.1 postgresql10-plperl-10.9-lp151.2.3.1 postgresql10-plperl-debuginfo-10.9-lp151.2.3.1 postgresql10-plpython-10.9-lp151.2.3.1 postgresql10-plpython-debuginfo-10.9-lp151.2.3.1 postgresql10-pltcl-10.9-lp151.2.3.1 postgresql10-pltcl-debuginfo-10.9-lp151.2.3.1 postgresql10-server-10.9-lp151.2.3.1 postgresql10-server-debuginfo-10.9-lp151.2.3.1 postgresql10-test-10.9-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): postgresql10-docs-10.9-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): libecpg6-32bit-10.9-lp151.2.3.1 libecpg6-32bit-debuginfo-10.9-lp151.2.3.1 libpq5-32bit-10.9-lp151.2.3.1 libpq5-32bit-debuginfo-10.9-lp151.2.3.1 - openSUSE Leap 15.0 (i586 x86_64): libecpg6-10.9-lp150.3.10.1 libecpg6-debuginfo-10.9-lp150.3.10.1 libpq5-10.9-lp150.3.10.1 libpq5-debuginfo-10.9-lp150.3.10.1 postgresql10-10.9-lp150.3.10.1 postgresql10-contrib-10.9-lp150.3.10.1 postgresql10-contrib-debuginfo-10.9-lp150.3.10.1 postgresql10-debuginfo-10.9-lp150.3.10.1 postgresql10-debugsource-10.9-lp150.3.10.1 postgresql10-devel-10.9-lp150.3.10.1 postgresql10-devel-debuginfo-10.9-lp150.3.10.1 postgresql10-plperl-10.9-lp150.3.10.1 postgresql10-plperl-debuginfo-10.9-lp150.3.10.1 postgresql10-plpython-10.9-lp150.3.10.1 postgresql10-plpython-debuginfo-10.9-lp150.3.10.1 postgresql10-pltcl-10.9-lp150.3.10.1 postgresql10-pltcl-debuginfo-10.9-lp150.3.10.1 postgresql10-server-10.9-lp150.3.10.1 postgresql10-server-debuginfo-10.9-lp150.3.10.1 postgresql10-test-10.9-lp150.3.10.1 - openSUSE Leap 15.0 (noarch): postgresql10-docs-10.9-lp150.3.10.1 - openSUSE Leap 15.0 (x86_64): libecpg6-32bit-10.9-lp150.3.10.1 libecpg6-32bit-debuginfo-10.9-lp150.3.10.1 libpq5-32bit-10.9-lp150.3.10.1 libpq5-32bit-debuginfo-10.9-lp150.3.10.1 References: https://www.suse.com/security/cve/CVE-2019-10130.html https://www.suse.com/security/cve/CVE-2019-10164.html https://bugzilla.suse.com/1134689 https://bugzilla.suse.com/1138034

1 0

openSUSE-RU-2019:1761-1: moderate: Recommended update for gd
by maintenance＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Recommended Update: Recommended update for gd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1761-1 Rating: moderate References: #1136574 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gd fixes the following issues: - Change order while installing splitted library. (bsc#1136574) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1761=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1761=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): gd-2.2.5-lp151.6.3.1 gd-debuginfo-2.2.5-lp151.6.3.1 gd-debugsource-2.2.5-lp151.6.3.1 gd-devel-2.2.5-lp151.6.3.1 libgd3-2.2.5-lp151.6.3.1 libgd3-debuginfo-2.2.5-lp151.6.3.1 - openSUSE Leap 15.1 (x86_64): libgd3-32bit-2.2.5-lp151.6.3.1 libgd3-32bit-debuginfo-2.2.5-lp151.6.3.1 - openSUSE Leap 15.0 (i586 x86_64): gd-2.2.5-lp150.11.1 gd-debuginfo-2.2.5-lp150.11.1 gd-debugsource-2.2.5-lp150.11.1 gd-devel-2.2.5-lp150.11.1 libgd3-2.2.5-lp150.11.1 libgd3-debuginfo-2.2.5-lp150.11.1 - openSUSE Leap 15.0 (x86_64): libgd3-32bit-2.2.5-lp150.11.1 libgd3-32bit-debuginfo-2.2.5-lp150.11.1 References: https://bugzilla.suse.com/1136574

1 0

openSUSE-SU-2019:1759-1: important: Security update for neovim
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for neovim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1759-1 Rating: important References: #1137443 Cross-References: CVE-2019-12735 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for neovim fixes the following issues: neovim was updated to version 0.3.7: * CVE-2019-12735: source should check sandbox (boo#1137443) * genappimage.sh: migrate to linuxdeploy Version Update to version 0.3.5: * options: properly reset directories on 'autochdir' * Remove MSVC optimization workaround for SHM_ALL * Make SHM_ALL to a variable instead of a compound literal #define * doc: mention "pynvim" module rename * screen: don't crash when drawing popupmenu with 'rightleft' option * look-behind match may use the wrong line number * :terminal : set topline based on window height * :recover : Fix crash on non-existent *.swp Version Update to version 0.3.4: * test: add tests for conceal cursor movement * display: unify ursorline and concealcursor redraw logic Version Update to version 0.3.3: * health/provider: Check for available pynvim when neovim mod is missing * python#CheckForModule: Use the given module string instead of hard-coding pynvim * (health.provider)/python: Import the neovim, rather than pynvim, module * TUI: Konsole DECSCUSR fixup Version Update to version 0.3.2:- * Features - clipboard: support Custom VimL functions (#9304) - win/TUI: improve terminal/console support (#9401) - startup: Use $XDG_CONFIG_DIRS/nvim/sysinit.vim if exists (#9077) - support mapping in more places (#9299) - diff/highlight: show underline for low-priority CursorLine (#9028) - signs: Add "nuhml" argument (#9113) - clipboard: support Wayland (#9230) - TUI: add support for undercurl and underline color (#9052) - man.vim: soft (dynamic) wrap (#9023) * API - API: implement object namespaces (#6920) - API: implement nvim_win_set_buf() (#9100) - API: virtual text annotations (nvim_buf_set_virtual_text) (#8180) - API: add nvim_buf_is_loaded() (#8660) - API: nvm_buf_get_offset_for_line (#8221) - API/UI: ext_newgrid, ext_histate (#8221) * UI - TUI: use BCE again more often (smoother resize) (#8806) - screen: add missing status redraw when redraw_later(CLEAR) was used (#9315) - TUI: clip invalid regions on resize (#8779) - TUI: improvements for scrolling and clearing (#9193) - TUI: disable clearing almost everywhere (#9143) - TUI: always use safe cursor movement after resize (#9079) - ui_options: also send when starting or from OptionSet (#9211) - TUI: Avoid reset_color_cursor_color in old VTE (#9191) - Don't erase screen on :hi Normal during startup (#9021) - TUI: Hint wrapped lines to terminals (#8915) * FIXES - RPC: turn errors from async calls into notifications - TUI: Restore terminal title via "title stacking" (#9407) - genappimage: Unset $ARGV0 at invocation (#9376) - TUI: Konsole 18.07.70 supports DECSCUSR (#9364) - provider: improve error message (#9344) - runtime/syntax: Fix highlighting of autogroup contents (#9328) - VimL/confirm(): Show dialog even if :silent (#9297) - clipboard: prefer xclip (#9302) - provider/nodejs: fix npm, yarn detection - channel: avoid buffering output when only terminal is active (#9218) - ruby: detect rbenv shims for other versions (#8733) - third party/unibilium: Fix parsing of extended capabilitiy entries (#9123) - jobstart(): Fix hang on non-executable cwd (#9204) - provide/nodejs: Simultaneously query npm and yarn (#9054) - undo: Fix infinite loop if undo_read_byte returns EOF (#2880) - 'swapfile: always show dialog' (#9034) - Add to the system-wide configuration file extension of runtimepath by /usr/share/vim/site, so that neovim uses other Vim plugins installed from packages. - Add /usr/share/vim/site tree of directories to be owned by neovim as well. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1759=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1759=1 Package List: - openSUSE Leap 15.1 (x86_64): neovim-0.3.7-lp151.2.7.1 neovim-debuginfo-0.3.7-lp151.2.7.1 neovim-debugsource-0.3.7-lp151.2.7.1 - openSUSE Leap 15.1 (noarch): neovim-lang-0.3.7-lp151.2.7.1 - openSUSE Leap 15.0 (x86_64): neovim-0.3.7-lp150.13.1 neovim-debuginfo-0.3.7-lp150.13.1 neovim-debugsource-0.3.7-lp150.13.1 - openSUSE Leap 15.0 (noarch): neovim-lang-0.3.7-lp150.13.1 References: https://www.suse.com/security/cve/CVE-2019-12735.html https://bugzilla.suse.com/1137443

1 0

openSUSE-SU-2019:1767-1: important: Security update for zeromq
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for zeromq ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1767-1 Rating: important References: #1082318 #1140255 Cross-References: CVE-2019-13132 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for zeromq fixes the following issues: - CVE-2019-13132: An unauthenticated remote attacker could have exploited a stack overflow vulnerability on a server that is supposed to be protected by encryption and authentication to potentially gain a remote code execution. (bsc#1140255) - Correctly mark license files as licence instead of documentation (bsc#1082318) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1767=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1767=1 Package List: - openSUSE Leap 15.1 (x86_64): libzmq5-4.2.3-lp151.5.3.1 libzmq5-debuginfo-4.2.3-lp151.5.3.1 zeromq-debugsource-4.2.3-lp151.5.3.1 zeromq-devel-4.2.3-lp151.5.3.1 zeromq-tools-4.2.3-lp151.5.3.1 zeromq-tools-debuginfo-4.2.3-lp151.5.3.1 - openSUSE Leap 15.0 (x86_64): libzmq5-4.2.3-lp150.2.15.1 libzmq5-debuginfo-4.2.3-lp150.2.15.1 zeromq-debugsource-4.2.3-lp150.2.15.1 zeromq-devel-4.2.3-lp150.2.15.1 zeromq-tools-4.2.3-lp150.2.15.1 zeromq-tools-debuginfo-4.2.3-lp150.2.15.1 References: https://www.suse.com/security/cve/CVE-2019-13132.html https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1140255

1 0

openSUSE-RU-2019:1769-1: moderate: Recommended update for python-relatorio
by maintenance＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Recommended Update: Recommended update for python-relatorio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1769-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for python-relatorio fixes the following issues: - python-magic added to requirements Update to version 0.8.1: * Add support for Python 3.7 * Escape invalid XML characters * Enforce closing tag to be the same directive as the opening * Use compression for zip file * Write mimetype as first file of the zip file Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1769=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1769=1 Package List: - openSUSE Leap 15.1 (noarch): python2-relatorio-0.8.1-lp151.3.3.1 python3-relatorio-0.8.1-lp151.3.3.1 - openSUSE Leap 15.0 (noarch): python2-relatorio-0.8.1-lp150.2.3.1 python3-relatorio-0.8.1-lp150.2.3.1 References:

1 0

openSUSE-RU-2019:1762-1: moderate: Recommended update for perl-Tk
by maintenance＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Recommended Update: Recommended update for perl-Tk ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1762-1 Rating: moderate References: #1134134 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for perl-Tk fixes the following issues: - Tk::Photo importer fails on some XPM files. (bsc#1134134) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1762=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1762=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): perl-Tk-804.034-lp151.3.3.1 perl-Tk-debuginfo-804.034-lp151.3.3.1 perl-Tk-debugsource-804.034-lp151.3.3.1 perl-Tk-devel-804.034-lp151.3.3.1 - openSUSE Leap 15.0 (i586 x86_64): perl-Tk-804.034-lp150.2.3.1 perl-Tk-debuginfo-804.034-lp150.2.3.1 perl-Tk-debugsource-804.034-lp150.2.3.1 perl-Tk-devel-804.034-lp150.2.3.1 References: https://bugzilla.suse.com/1134134

1 0

openSUSE-SU-2019:1770-1: moderate: Security update for kernel-firmware
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for kernel-firmware ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1770-1 Rating: moderate References: #1136334 #1136498 #1139383 Cross-References: CVE-2019-9836 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for kernel-firmware fixes the following issues: kernel-firmware was updated to version 20190618: * cavium: Add firmware for CNN55XX crypto driver. * linux-firmware: Update firmware file for Intel Bluetooth 22161 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * linux-firmware: Update AMD SEV firmware (CVE-2019-9836, bsc#1139383) * linux-firmware: update licence text for Marvell firmware * linux-firmware: update firmware for mhdp8546 * linux-firmware: rsi: update firmware images for Redpine 9113 chipset * imx: sdma: update firmware to v3.5/v4.5 * nvidia: update GP10[2467] SEC2 RTOS with the one already used on GP108 * linux-firmware: Update firmware file for Intel Bluetooth 8265 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * amlogic: add video decoder firmwares * iwlwifi: update -46 firmwares for 22260 and 9000 series * iwlwifi: add firmware for 22260 and update 9000 series -46 firmwares * iwlwifi: add -46.ucode firmwares for 9000 series * amdgpu: update vega20 to the latest 19.10 firmware * amdgpu: update vega12 to the latest 19.10 firmware * amdgpu: update vega10 to the latest 19.10 firmware * amdgpu: update polaris11 to the latest 19.10 firmware * amdgpu: update polaris10 to the latest 19.10 firmware * amdgpu: update raven2 to the latest 19.10 firmware * amdgpu: update raven to the latest 19.10 firmware * amdgpu: update picasso to the latest 19.10 firmware * linux-firmware: update fw for qat devices * Mellanox: Add new mlxsw_spectrum firmware 13.2000.1122 * drm/i915/firmware: Add ICL HuC v8.4.3238 * drm/i915/firmware: Add ICL GuC v32.0.3 * drm/i915/firmware: Add GLK HuC v03.01.2893 * drm/i915/firmware: Add GLK GuC v32.0.3 * drm/i915/firmware: Add KBL GuC v32.0.3 * drm/i915/firmware: Add SKL GuC v32.0.3 * drm/i915/firmware: Add BXT GuC v32.0.3 * linux-firmware: Add firmware file for Intel Bluetooth 22161 * cxgb4: update firmware to revision 1.23.4.0 (bsc#1136334) * linux-firmware: Update NXP Management Complex firmware to version 10.14.3 * linux-firmware: add firmware for MT7615E * mediatek: update MT8173 VPU firmware to v1.1.2 [decoder] Enlarge struct vdec_pic_info to support more capture buffer plane and capture buffer format change. * linux-firmware: update Marvell 8797/8997 firmware images * nfp: update Agilio SmartNIC flower firmware to rev AOTC-2.10.A.23 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1770=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1770=1 Package List: - openSUSE Leap 15.1 (noarch): kernel-firmware-20190618-lp151.2.6.1 ucode-amd-20190618-lp151.2.6.1 - openSUSE Leap 15.0 (noarch): kernel-firmware-20190618-lp150.2.19.1 ucode-amd-20190618-lp150.2.19.1 References: https://www.suse.com/security/cve/CVE-2019-9836.html https://bugzilla.suse.com/1136334 https://bugzilla.suse.com/1136498 https://bugzilla.suse.com/1139383

1 0