August 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2019:2020-1: important: Recommended update for kernel-firmware
by maintenance＠opensuse.org 29 Aug '19

29 Aug '19

openSUSE Recommended Update: Recommended update for kernel-firmware ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2020-1 Rating: important References: #1143331 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kernel-firmware fixes the following issues: - Reverts a patch which has caused systems to hang during booting in specific scenarios (bsc#1143331) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2020=1 Package List: - openSUSE Leap 15.0 (noarch): kernel-firmware-20190618-lp150.2.22.1 ucode-amd-20190618-lp150.2.22.1 References: https://bugzilla.suse.com/1143331

1 0

openSUSE-SU-2019:2021-1: important: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork
by opensuse-security＠opensuse.org 29 Aug '19

29 Aug '19

openSUSE Security Update: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2021-1 Rating: important References: #1100331 #1121967 #1138920 #1139649 #1142160 #1142413 #1143409 Cross-References: CVE-2018-10892 CVE-2019-13509 CVE-2019-14271 CVE-2019-5736 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves four vulnerabilities and has three fixes is now available. Description: This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues: Docker: - CVE-2019-14271: Fixed a code injection if the nsswitch facility dynamically loaded a library inside a chroot (bsc#1143409). - CVE-2019-13509: Fixed an information leak in the debug log (bsc#1142160). - Update to version 19.03.1-ce, see changelog at /usr/share/doc/packages/docker/CHANGELOG.md (bsc#1142413, bsc#1139649). runc: - Use %config(noreplace) for /etc/docker/daemon.json (bsc#1138920). - Update to runc 425e105d5a03, which is required by Docker (bsc#1139649). containerd: - CVE-2019-5736: Fixed a container breakout vulnerability (bsc#1121967). - Update to containerd v1.2.6, which is required by docker (bsc#1139649). golang-github-docker-libnetwork: - Update to version git.fc5a7d91d54cc98f64fc28f9e288b46a0bee756c, which is required by docker (bsc#1142413, bsc#1139649). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2021=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2021=1 Package List: - openSUSE Leap 15.1 (x86_64): containerd-1.2.6-lp151.2.6.1 containerd-ctr-1.2.6-lp151.2.6.1 docker-19.03.1_ce-lp151.2.12.1 docker-debuginfo-19.03.1_ce-lp151.2.12.1 docker-libnetwork-0.7.0.1+gitr2800_fc5a7d91d54c-lp151.2.6.1 docker-libnetwork-debuginfo-0.7.0.1+gitr2800_fc5a7d91d54c-lp151.2.6.1 docker-runc-1.0.0rc8+gitr3826_425e105d5a03-lp151.3.6.1 docker-runc-debuginfo-1.0.0rc8+gitr3826_425e105d5a03-lp151.3.6.1 docker-test-19.03.1_ce-lp151.2.12.1 docker-test-debuginfo-19.03.1_ce-lp151.2.12.1 golang-github-docker-libnetwork-0.7.0.1+gitr2800_fc5a7d91d54c-lp151.2.6.1 - openSUSE Leap 15.1 (noarch): docker-bash-completion-19.03.1_ce-lp151.2.12.1 docker-zsh-completion-19.03.1_ce-lp151.2.12.1 - openSUSE Leap 15.0 (x86_64): containerd-1.2.6-lp150.4.17.1 containerd-ctr-1.2.6-lp150.4.17.1 docker-19.03.1_ce-lp150.5.27.1 docker-debuginfo-19.03.1_ce-lp150.5.27.1 docker-libnetwork-0.7.0.1+gitr2800_fc5a7d91d54c-lp150.3.18.1 docker-libnetwork-debuginfo-0.7.0.1+gitr2800_fc5a7d91d54c-lp150.3.18.1 docker-runc-1.0.0rc8+gitr3826_425e105d5a03-lp150.5.25.1 docker-runc-debuginfo-1.0.0rc8+gitr3826_425e105d5a03-lp150.5.25.1 docker-test-19.03.1_ce-lp150.5.27.1 docker-test-debuginfo-19.03.1_ce-lp150.5.27.1 golang-github-docker-libnetwork-0.7.0.1+gitr2800_fc5a7d91d54c-lp150.3.18.1 - openSUSE Leap 15.0 (noarch): docker-bash-completion-19.03.1_ce-lp150.5.27.1 docker-zsh-completion-19.03.1_ce-lp150.5.27.1 References: https://www.suse.com/security/cve/CVE-2018-10892.html https://www.suse.com/security/cve/CVE-2019-13509.html https://www.suse.com/security/cve/CVE-2019-14271.html https://www.suse.com/security/cve/CVE-2019-5736.html https://bugzilla.suse.com/1100331 https://bugzilla.suse.com/1121967 https://bugzilla.suse.com/1138920 https://bugzilla.suse.com/1139649 https://bugzilla.suse.com/1142160 https://bugzilla.suse.com/1142413 https://bugzilla.suse.com/1143409

1 0

openSUSE-SU-2019:2019-1: important: Security update for schismtracker
by opensuse-security＠opensuse.org 29 Aug '19

29 Aug '19

openSUSE Security Update: Security update for schismtracker ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2019-1 Rating: important References: #1144261 #1144266 Cross-References: CVE-2019-14523 CVE-2019-14524 Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for schismtracker fixes the following issues: The following security issues were fixed: - CVE-2019-14523: Fixed an integer underflow in the Amiga Oktalyzer parser (boo#1144266). - CVE-2019-14524: Fixed a heap overflow in the MTM loader (boo#1144261). The following non-security issues were fixed: - Support 15-channel MOD files. - Support undocumented MIDI macro characters, and support character p (MIDI program) properly. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2019=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2019=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): schismtracker-20190805-bp151.4.3.1 schismtracker-debuginfo-20190805-bp151.4.3.1 schismtracker-debugsource-20190805-bp151.4.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): schismtracker-20190805-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-14523.html https://www.suse.com/security/cve/CVE-2019-14524.html https://bugzilla.suse.com/1144261 https://bugzilla.suse.com/1144266

1 0

openSUSE-RU-2019:2018-1: moderate: Recommended update for skiboot
by maintenance＠opensuse.org 27 Aug '19

27 Aug '19

openSUSE Recommended Update: Recommended update for skiboot ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2018-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for skiboot fixes the following issues: skiboot was updated to 5.10.7: - NPU2 HMIs: dump out a *LOT* of npu2 registers for debugging - libflash/blocklevel: Correct miscalculation in blocklevel_smart_erase() - Tie tm-suspend fw-feature and opal_reinit_cpus() together - NPU2: dump NPU2 registers on npu2 HMI - npu2: Add performance tuning SCOM inits - hw/npu2: Assign a unique LPARSHORTID per GPU - occ: Set up OCC messaging even if we fail to setup pstates - core/fast-reboot: disable fast reboot upon fundamental entry/exit/locking errors - core/opal: allow some re-entrant calls - core/opal: abort in case of re-entrant OPAL call - npu2: Disable fast reboot - xive: disable store EOI support - npu2/hw-procedures: fence bricks on GPU reset - hdata/spira: parse vpd to add part-number and serial-number to xscom@ node - hw/imc: Check for pause_microcode_at_boot() return status - core/cpufeatures: Fix setting DARN and SCV HWCAP feature bits - opal-prd: Do not error out on first failure for soft/hard offline. - xive: fix missing unlock in error path - OPAL_PCI_SET_POWER_STATE: fix locking in error paths - libffs: Fix string truncation gcc warning. - hdata/i2c.c: fix building with gcc8 - opal-prd: Fix opal-prd crash This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2018=1 Package List: - openSUSE Backports SLE-15 (ppc64le): opal-prd-5.10.7-bp150.2.9.1 opal-utils-5.10.7-bp150.2.9.1 References:

1 0

openSUSE-SU-2019:2017-1: moderate: Recommended update for putty
by opensuse-security＠opensuse.org 26 Aug '19

26 Aug '19

openSUSE Security Update: Recommended update for putty ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2017-1 Rating: moderate References: #1144547 #1144548 Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for putty fixes the following issues: Update to new upstream release 0.72 [boo#1144547, boo#1144548] * Fixed two separate vulnerabilities affecting the obsolete SSH-1 protocol, both available before host key checking. * Fixed a vulnerability in all the SSH client tools (PuTTY, Plink, PSFTP and PSCP) if a malicious program can impersonate Pageant. * Fixed a crash in GSSAPI / Kerberos key exchange triggered if the server provided an ordinary SSH host key as part of the exchange. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2017=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2017=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): putty-0.72-bp151.4.3.1 putty-debuginfo-0.72-bp151.4.3.1 putty-debugsource-0.72-bp151.4.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): putty-0.72-bp150.4.9.1 References: https://bugzilla.suse.com/1144547 https://bugzilla.suse.com/1144548

1 0

openSUSE-SU-2019:2015-1: important: Security update for vlc
by opensuse-security＠opensuse.org 26 Aug '19

26 Aug '19

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2015-1 Rating: important References: #1093732 #1094893 #1118586 #1133290 #1138354 #1138933 #1141522 #1142161 #1143547 #1143549 Cross-References: CVE-2018-19857 CVE-2019-12874 CVE-2019-13602 CVE-2019-13962 CVE-2019-5439 CVE-2019-5459 CVE-2019-5460 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has three fixes is now available. Description: This update for vlc to version 3.0.7.1 fixes the following issues: Security issues fixed: - CVE-2019-5439: Fixed a buffer overflow (bsc#1138354). - CVE-2019-5459: Fixed an integer underflow (bsc#1143549). - CVE-2019-5460: Fixed a double free (bsc#1143547). - CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933). - CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522). - CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161). Non-security issues fixed: - Video Output: * Fix hardware acceleration with some AMD drivers * Improve direct3d11 HDR support - Access: * Improve Blu-ray support - Audio output: * Fix pass-through on Android-23 * Fix DirectSound drain - Demux: Improve MP4 support - Video Output: * Fix 12 bits sources playback with Direct3D11 * Fix crash on iOS * Fix midstream aspect-ratio changes when Windows hardware decoding is on * Fix HLG display with Direct3D11 - Stream Output: Improve Chromecast support with new ChromeCast apps - Misc: * Update Youtube, Dailymotion, Vimeo, Soundcloud scripts * Work around busy looping when playing an invalid item with loop enabled - Updated translations. New package libaom: * Initial version 1.0.0 * A library for AOMedia Video 1 (AV1), an open, royalty-free video coding format designed for video transmissions over the Internet. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2015=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): aom-tools-1.0.0-bp150.2.1 aom-tools-debuginfo-1.0.0-bp150.2.1 libaom-debugsource-1.0.0-bp150.2.1 libaom-devel-1.0.0-bp150.2.1 libaom0-1.0.0-bp150.2.1 libaom0-debuginfo-1.0.0-bp150.2.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libaom0-64bit-1.0.0-bp150.2.1 libaom0-64bit-debuginfo-1.0.0-bp150.2.1 - openSUSE Backports SLE-15 (x86_64): libvlc5-3.0.7.1-bp150.2.6.1 libvlccore9-3.0.7.1-bp150.2.6.1 vlc-3.0.7.1-bp150.2.6.1 vlc-codec-gstreamer-3.0.7.1-bp150.2.6.1 vlc-devel-3.0.7.1-bp150.2.6.1 vlc-jack-3.0.7.1-bp150.2.6.1 vlc-noX-3.0.7.1-bp150.2.6.1 vlc-qt-3.0.7.1-bp150.2.6.1 vlc-vdpau-3.0.7.1-bp150.2.6.1 - openSUSE Backports SLE-15 (noarch): libaom-devel-doc-1.0.0-bp150.2.1 vlc-lang-3.0.7.1-bp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-19857.html https://www.suse.com/security/cve/CVE-2019-12874.html https://www.suse.com/security/cve/CVE-2019-13602.html https://www.suse.com/security/cve/CVE-2019-13962.html https://www.suse.com/security/cve/CVE-2019-5439.html https://www.suse.com/security/cve/CVE-2019-5459.html https://www.suse.com/security/cve/CVE-2019-5460.html https://bugzilla.suse.com/1093732 https://bugzilla.suse.com/1094893 https://bugzilla.suse.com/1118586 https://bugzilla.suse.com/1133290 https://bugzilla.suse.com/1138354 https://bugzilla.suse.com/1138933 https://bugzilla.suse.com/1141522 https://bugzilla.suse.com/1142161 https://bugzilla.suse.com/1143547 https://bugzilla.suse.com/1143549

1 0

openSUSE-RU-2019:2014-1: moderate: Recommended update for python-billiard
by maintenance＠opensuse.org 25 Aug '19

25 Aug '19

openSUSE Recommended Update: Recommended update for python-billiard ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2014-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for python-billiard fixes the following issues: - Adjust description grammar. Drop filler wording. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2014=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2014=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): python-billiard-debugsource-3.6.0.0-bp151.4.6.1 python2-billiard-3.6.0.0-bp151.4.6.1 python2-billiard-debuginfo-3.6.0.0-bp151.4.6.1 - openSUSE Backports SLE-15-SP1 (noarch): python-billiard-doc-3.6.0.0-bp151.4.6.1 python3-billiard-3.6.0.0-bp151.4.6.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): python2-billiard-3.6.0.0-bp150.2.6.1 - openSUSE Backports SLE-15 (noarch): python-billiard-doc-3.6.0.0-bp150.2.6.1 python3-billiard-3.6.0.0-bp150.2.6.1 References:

1 0

openSUSE-RU-2019:2013-1: moderate: Recommended update for gnuhealth-client, gnuhealth-thalamus, tryton, trytond, trytond_account, trytond_stock
by maintenance＠opensuse.org 25 Aug '19

25 Aug '19

openSUSE Recommended Update: Recommended update for gnuhealth-client, gnuhealth-thalamus, tryton, trytond, trytond_account, trytond_stock ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2013-1 Rating: moderate References: #1141369 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gnuhealth-client, gnuhealth-thalamus, tryton, trytond, trytond_account, trytond_stock fixes the following issues: Bugfix release for gnuthealth and tryton (boo#1141369) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2013=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): gnuhealth-client-3.4.4-bp151.3.3.1 gnuhealth-thalamus-0.9.9-bp151.2.3.1 tryton-4.6.21-bp151.3.3.1 trytond-4.6.17-bp151.3.3.1 trytond_account-4.6.10-bp151.3.3.1 trytond_stock-4.6.7-bp151.3.3.1 References: https://bugzilla.suse.com/1141369

1 0

openSUSE-RU-2019:2006-1: moderate: Recommended update for apache2-mod_auth_kerb
by maintenance＠opensuse.org 24 Aug '19

24 Aug '19

openSUSE Recommended Update: Recommended update for apache2-mod_auth_kerb ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2006-1 Rating: moderate References: #1142545 Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for apache2-mod_auth_kerb fixes the following issues: - Fix a segmentation fault in function authenticate_user_krb5pwd() when credentials were supplied using basic authentication [boo#1142545] This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2006=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2006=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): apache2-mod_auth_kerb-5.4-bp151.4.3.1 apache2-mod_auth_kerb-debuginfo-5.4-bp151.4.3.1 apache2-mod_auth_kerb-debugsource-5.4-bp151.4.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): apache2-mod_auth_kerb-5.4-bp150.3.3.1 References: https://bugzilla.suse.com/1142545

1 0

openSUSE-SU-2019:2005-1: moderate: Security update for qbittorrent
by opensuse-security＠opensuse.org 24 Aug '19

24 Aug '19

openSUSE Security Update: Security update for qbittorrent ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2005-1 Rating: moderate References: #1141967 Cross-References: CVE-2019-13640 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for qbittorrent fixes the following issues: - CVE-2019-13640: avoid command injection (boo#1141967) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2005=1 Package List: - openSUSE Leap 15.1 (x86_64): qbittorrent-4.1.5-lp151.2.3.1 qbittorrent-debuginfo-4.1.5-lp151.2.3.1 qbittorrent-debugsource-4.1.5-lp151.2.3.1 qbittorrent-nox-4.1.5-lp151.2.3.1 qbittorrent-nox-debuginfo-4.1.5-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-13640.html https://bugzilla.suse.com/1141967

1 0