November 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:2595-1: moderate: Security update for clamav
by opensuse-security＠opensuse.org 30 Nov '19

30 Nov '19

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2595-1 Rating: moderate References: #1144504 #1149458 #1151839 Cross-References: CVE-2019-12625 CVE-2019-12900 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for clamav fixes the following issues: Security issue fixed: - CVE-2019-12625: Fixed a ZIP bomb issue by adding detection and heuristics for zips with overlapping files (bsc#1144504). - CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors (bsc#1149458). Non-security issues fixed: - Added the --max-scantime clamscan option and MaxScanTime clamd configuration option (bsc#1144504). - Increased the startup timeout of clamd to 5 minutes to cater for the grown virus database as a workaround until clamd has learned to talk to systemd to extend the timeout as long as needed (bsc#1151839). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2595=1 Package List: - openSUSE Leap 15.1 (x86_64): clamav-0.100.3-lp151.2.3.1 clamav-debuginfo-0.100.3-lp151.2.3.1 clamav-debugsource-0.100.3-lp151.2.3.1 clamav-devel-0.100.3-lp151.2.3.1 libclamav7-0.100.3-lp151.2.3.1 libclamav7-debuginfo-0.100.3-lp151.2.3.1 libclammspack0-0.100.3-lp151.2.3.1 libclammspack0-debuginfo-0.100.3-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-12625.html https://www.suse.com/security/cve/CVE-2019-12900.html https://bugzilla.suse.com/1144504 https://bugzilla.suse.com/1149458 https://bugzilla.suse.com/1151839

1 0

openSUSE-SU-2019:2594-1: important: Security update for strongswan
by opensuse-security＠opensuse.org 30 Nov '19

30 Nov '19

openSUSE Security Update: Security update for strongswan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2594-1 Rating: important References: #1093536 #1094462 #1107874 #1109845 Cross-References: CVE-2018-10811 CVE-2018-16151 CVE-2018-16152 CVE-2018-17540 CVE-2018-5388 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for strongswan fixes the following issues: Security issues fixed: - CVE-2018-5388: Fixed a buffer underflow which may allow to a remote attacker with local user credentials to resource exhaustion and denial of service while reading from the socket (bsc#1094462). - CVE-2018-10811: Fixed a denial of service during the IKEv2 key derivation if the openssl plugin is used in FIPS mode and HMAC-MD5 is negotiated as PRF (bsc#1093536). - CVE-2018-16151,CVE-2018-16152: Fixed multiple flaws in the gmp plugin which might lead to authorization bypass (bsc#1107874). - CVE-2018-17540: Fixed an improper input validation in gmp plugin (bsc#1109845). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2594=1 Package List: - openSUSE Leap 15.0 (noarch): strongswan-doc-5.6.0-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): strongswan-5.6.0-lp150.3.3.1 strongswan-debuginfo-5.6.0-lp150.3.3.1 strongswan-debugsource-5.6.0-lp150.3.3.1 strongswan-hmac-5.6.0-lp150.3.3.1 strongswan-ipsec-5.6.0-lp150.3.3.1 strongswan-ipsec-debuginfo-5.6.0-lp150.3.3.1 strongswan-libs0-5.6.0-lp150.3.3.1 strongswan-libs0-debuginfo-5.6.0-lp150.3.3.1 strongswan-mysql-5.6.0-lp150.3.3.1 strongswan-mysql-debuginfo-5.6.0-lp150.3.3.1 strongswan-nm-5.6.0-lp150.3.3.1 strongswan-nm-debuginfo-5.6.0-lp150.3.3.1 strongswan-sqlite-5.6.0-lp150.3.3.1 strongswan-sqlite-debuginfo-5.6.0-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-10811.html https://www.suse.com/security/cve/CVE-2018-16151.html https://www.suse.com/security/cve/CVE-2018-16152.html https://www.suse.com/security/cve/CVE-2018-17540.html https://www.suse.com/security/cve/CVE-2018-5388.html https://bugzilla.suse.com/1093536 https://bugzilla.suse.com/1094462 https://bugzilla.suse.com/1107874 https://bugzilla.suse.com/1109845

1 0

openSUSE-SU-2019:2596-1: moderate: Security update for cpio
by opensuse-security＠opensuse.org 30 Nov '19

30 Nov '19

openSUSE Security Update: Security update for cpio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2596-1 Rating: moderate References: #1155199 Cross-References: CVE-2019-14866 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cpio fixes the following issues: - CVE-2019-14866: Fixed an improper validation of the values written in the header of a TAR file through the to_oct() function which could have led to unexpected TAR generation (bsc#1155199). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2596=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): cpio-2.12-lp151.3.3.1 cpio-debuginfo-2.12-lp151.3.3.1 cpio-debugsource-2.12-lp151.3.3.1 cpio-mt-2.12-lp151.3.3.1 cpio-mt-debuginfo-2.12-lp151.3.3.1 - openSUSE Leap 15.1 (noarch): cpio-lang-2.12-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-14866.html https://bugzilla.suse.com/1155199

1 0

openSUSE-SU-2019:2593-1: moderate: Security update for cpio
by opensuse-security＠opensuse.org 30 Nov '19

30 Nov '19

openSUSE Security Update: Security update for cpio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2593-1 Rating: moderate References: #1155199 Cross-References: CVE-2019-14866 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cpio fixes the following issues: - CVE-2019-14866: Fixed an improper validation of the values written in the header of a TAR file through the to_oct() function which could have led to unexpected TAR generation (bsc#1155199). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2593=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): cpio-2.12-lp150.2.3.1 cpio-debuginfo-2.12-lp150.2.3.1 cpio-debugsource-2.12-lp150.2.3.1 cpio-mt-2.12-lp150.2.3.1 cpio-mt-debuginfo-2.12-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): cpio-lang-2.12-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-14866.html https://bugzilla.suse.com/1155199

1 0

openSUSE-RU-2019:2590-1: moderate: Recommended update for gnuhealth, gnuhealth-client, proteus, tryton, trytond, trytond_account, trytond_account_product, trytond_product, trytond_stock_supply
by maintenance＠opensuse.org 30 Nov '19

30 Nov '19

openSUSE Recommended Update: Recommended update for gnuhealth, gnuhealth-client, proteus, tryton, trytond, trytond_account, trytond_account_product, trytond_product, trytond_stock_supply ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2590-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for gnuhealth, gnuhealth-client, proteus, tryton, trytond, trytond_account, trytond_account_product, trytond_product, trytond_stock_supply fixes the following issues: - proteus was updated to version 4.6.9 - Bugfix Release - tryton was updated to version 4.6.24 - Bugfix Release - trytond was updated to version 4.6.22 - Bugfix Release - trytond_account was updated to version 4.6.11 - Bugfix Release - trytond_account_product was updated to version 4.6.2 - Bugfix Release - trytond_product was updated to version 4.6.1 - Bugfix Release - trytond_stock_supply was updated to version 4.6.4 - Bugfix Release Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2590=1 Package List: - openSUSE Leap 15.1 (noarch): gnuhealth-3.4.1-lp151.2.6.1 gnuhealth-client-3.4.4-lp151.2.6.1 proteus-4.6.9-lp151.2.3.1 tryton-4.6.24-lp151.2.6.1 trytond-4.6.22-lp151.3.9.1 trytond_account-4.6.11-lp151.3.6.1 trytond_account_product-4.6.2-lp151.2.3.1 trytond_product-4.6.1-lp151.2.3.1 trytond_stock_supply-4.6.4-lp151.2.3.1 References:

1 0

openSUSE-SU-2019:2591-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 30 Nov '19

30 Nov '19

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2591-1 Rating: important References: #1155321 #1156318 Cross-References: CVE-2019-8551 CVE-2019-8558 CVE-2019-8559 CVE-2019-8563 CVE-2019-8625 CVE-2019-8674 CVE-2019-8681 CVE-2019-8684 CVE-2019-8686 CVE-2019-8687 CVE-2019-8688 CVE-2019-8689 CVE-2019-8690 CVE-2019-8707 CVE-2019-8710 CVE-2019-8719 CVE-2019-8720 CVE-2019-8726 CVE-2019-8733 CVE-2019-8735 CVE-2019-8743 CVE-2019-8763 CVE-2019-8764 CVE-2019-8765 CVE-2019-8766 CVE-2019-8768 CVE-2019-8769 CVE-2019-8771 CVE-2019-8782 CVE-2019-8783 CVE-2019-8808 CVE-2019-8811 CVE-2019-8812 CVE-2019-8813 CVE-2019-8814 CVE-2019-8815 CVE-2019-8816 CVE-2019-8819 CVE-2019-8820 CVE-2019-8821 CVE-2019-8822 CVE-2019-8823 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 42 vulnerabilities is now available. Description: This update for webkit2gtk3 to version 2.26.2 fixes the following issues: Webkit2gtk3 was updated to version 2.26.2 (WSA-2019-0005 and WSA-2019-0006, bsc#1155321 bsc#1156318) Security issues addressed: - CVE-2019-8625: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8674: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8707: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8719: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8720: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8726: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8733: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8735: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8763: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8768: Fixed an issue where a user may be unable to delete browsing history items. - CVE-2019-8769: Fixed an issue where a maliciously crafted website may reveal browsing history. - CVE-2019-8771: Fixed an issue where a maliciously crafted web content may violate iframe sandboxing policy. - CVE-2019-8710: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8743: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8764: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8765: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8766: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8782: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8783: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8808: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8811: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8812: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8813: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8814: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8815: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8816: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8819: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8820: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8821: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8822: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8823: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2591=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.26.2-lp151.2.9.1 libjavascriptcoregtk-4_0-18-debuginfo-2.26.2-lp151.2.9.1 libwebkit2gtk-4_0-37-2.26.2-lp151.2.9.1 libwebkit2gtk-4_0-37-debuginfo-2.26.2-lp151.2.9.1 typelib-1_0-JavaScriptCore-4_0-2.26.2-lp151.2.9.1 typelib-1_0-WebKit2-4_0-2.26.2-lp151.2.9.1 typelib-1_0-WebKit2WebExtension-4_0-2.26.2-lp151.2.9.1 webkit-jsc-4-2.26.2-lp151.2.9.1 webkit-jsc-4-debuginfo-2.26.2-lp151.2.9.1 webkit2gtk-4_0-injected-bundles-2.26.2-lp151.2.9.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.26.2-lp151.2.9.1 webkit2gtk3-debugsource-2.26.2-lp151.2.9.1 webkit2gtk3-devel-2.26.2-lp151.2.9.1 webkit2gtk3-minibrowser-2.26.2-lp151.2.9.1 webkit2gtk3-minibrowser-debuginfo-2.26.2-lp151.2.9.1 - openSUSE Leap 15.1 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.26.2-lp151.2.9.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.26.2-lp151.2.9.1 libwebkit2gtk-4_0-37-32bit-2.26.2-lp151.2.9.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.26.2-lp151.2.9.1 - openSUSE Leap 15.1 (noarch): libwebkit2gtk3-lang-2.26.2-lp151.2.9.1 References: https://www.suse.com/security/cve/CVE-2019-8551.html https://www.suse.com/security/cve/CVE-2019-8558.html https://www.suse.com/security/cve/CVE-2019-8559.html https://www.suse.com/security/cve/CVE-2019-8563.html https://www.suse.com/security/cve/CVE-2019-8625.html https://www.suse.com/security/cve/CVE-2019-8674.html https://www.suse.com/security/cve/CVE-2019-8681.html https://www.suse.com/security/cve/CVE-2019-8684.html https://www.suse.com/security/cve/CVE-2019-8686.html https://www.suse.com/security/cve/CVE-2019-8687.html https://www.suse.com/security/cve/CVE-2019-8688.html https://www.suse.com/security/cve/CVE-2019-8689.html https://www.suse.com/security/cve/CVE-2019-8690.html https://www.suse.com/security/cve/CVE-2019-8707.html https://www.suse.com/security/cve/CVE-2019-8710.html https://www.suse.com/security/cve/CVE-2019-8719.html https://www.suse.com/security/cve/CVE-2019-8720.html https://www.suse.com/security/cve/CVE-2019-8726.html https://www.suse.com/security/cve/CVE-2019-8733.html https://www.suse.com/security/cve/CVE-2019-8735.html https://www.suse.com/security/cve/CVE-2019-8743.html https://www.suse.com/security/cve/CVE-2019-8763.html https://www.suse.com/security/cve/CVE-2019-8764.html https://www.suse.com/security/cve/CVE-2019-8765.html https://www.suse.com/security/cve/CVE-2019-8766.html https://www.suse.com/security/cve/CVE-2019-8768.html https://www.suse.com/security/cve/CVE-2019-8769.html https://www.suse.com/security/cve/CVE-2019-8771.html https://www.suse.com/security/cve/CVE-2019-8782.html https://www.suse.com/security/cve/CVE-2019-8783.html https://www.suse.com/security/cve/CVE-2019-8808.html https://www.suse.com/security/cve/CVE-2019-8811.html https://www.suse.com/security/cve/CVE-2019-8812.html https://www.suse.com/security/cve/CVE-2019-8813.html https://www.suse.com/security/cve/CVE-2019-8814.html https://www.suse.com/security/cve/CVE-2019-8815.html https://www.suse.com/security/cve/CVE-2019-8816.html https://www.suse.com/security/cve/CVE-2019-8819.html https://www.suse.com/security/cve/CVE-2019-8820.html https://www.suse.com/security/cve/CVE-2019-8821.html https://www.suse.com/security/cve/CVE-2019-8822.html https://www.suse.com/security/cve/CVE-2019-8823.html https://bugzilla.suse.com/1155321 https://bugzilla.suse.com/1156318

1 0

openSUSE-RU-2019:2592-1: moderate: Recommended update for python-M2Crypto
by maintenance＠opensuse.org 30 Nov '19

30 Nov '19

openSUSE Recommended Update: Recommended update for python-M2Crypto ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2592-1 Rating: moderate References: #1149792 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-M2Crypto fixes the following issues: - Fix compatibility with OpenSSL 1.1.1c (bsc#1149792) - Upgrade OpenSSL (jsc#SLE-9135) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2592=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): python-M2Crypto-debuginfo-0.35.2-lp151.3.6.1 python-M2Crypto-debugsource-0.35.2-lp151.3.6.1 python2-M2Crypto-0.35.2-lp151.3.6.1 python2-M2Crypto-debuginfo-0.35.2-lp151.3.6.1 python3-M2Crypto-0.35.2-lp151.3.6.1 python3-M2Crypto-debuginfo-0.35.2-lp151.3.6.1 - openSUSE Leap 15.1 (noarch): python-M2Crypto-doc-0.35.2-lp151.3.6.1 References: https://bugzilla.suse.com/1149792

1 0

openSUSE-RU-2019:2586-1: moderate: Recommended update for drbd-formula, habootstrap-formula, python-shaptools, salt-shaptools, saphanabootstrap-formula, salt
by maintenance＠opensuse.org 30 Nov '19

30 Nov '19

openSUSE Recommended Update: Recommended update for drbd-formula, habootstrap-formula, python-shaptools, salt-shaptools, saphanabootstrap-formula, salt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2586-1 Rating: moderate References: #1101780 #1130588 #1134860 #1135567 #1135732 #1137642 #1137989 #1140912 #1142306 #1142762 #1143301 #1146192 #1146382 #1151650 #1151947 #1152366 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 16 recommended fixes can now be installed. Description: This update for drbd-formula, habootstrap-formula, python-shaptools, salt-shaptools, saphanabootstrap-formula and salt fixes the following issues: habootstrap-formula 0.2.9: * Fix issue with file permissions during package installation in /usr/share/salt-formulas (0755, root, salt) (boo#1142306) * Add customizable timeout to the join process and rename join_timer to wait_for_initialization * remove and replace hawk-apiserver with prometheus-ha_cluster_exporter pkg * Update the pkg.info_available call to avoid repositories refresh as it may cause errors * Add packages and ha_exporter options to the SUMA form.yml file * Fix typo in Pillar attribute name * Add HA monitoring to the formula salt-shaptools 0.2.3: - Create package version 0.2.3 with drbd files renamed. - Create package version 0.2.2 updating how additional_dvds is used in netweavermod - Create first salt modules and states to manage SAP Netweaver * Install ASCS SAP instance in a idempotent way python-shaptools 0.3.3: - Add update_conf_file for Netweaver - Add isconnected and reconnect methods - Add the required code to install SAP Netweaver instances * Wrap sapcontrol command usage * Install and uninstall SAP instances * Check current installation status - Add support for Power machines (jsc#SLE-4031, jsc#SLE-4143, boo#1137989) saphanabootstrap-formula 0.3.2: * Fix issue with file permissions during package installation in /usr/share/salt-formulas (0755, root, salt) (boo#1142306) * Fix 'true' rendering in jinja to convert to json correctly * Add support for multi tenant hanadb_exporter * Update the pkg.info_available call to avoid repositories refresh as it may cause errors * Fix issue with file permissions during package installation in /usr/share/salt-formulas (0755, root, salt) (boo#1142306) drbd-formula 0.3.7: * Retry the packages installation to make the code more robust * Remove additional_repos salt state * Fix issue with file permissions during package installation in /usr/share/salt-formulas (0755, root, salt) (boo#1142306) * Remove the duplicate default value in salt state * Not to install package by default * Remove salt indent and change the order of pillar * Add prefix to ID to avoid conflicts * Install xfsprogs when need to format xfs - Version 0.3.2, boo#1142762 * Restructure the deploy and examples directories * Add examples of using NFS formula * Fix the issue of mkfs and mount NFS share * Polish the form.yml based on SUMA4.0, change some default values. - Version 0.3.1 * Change the requires to salt-formulas-configuration as this is the virtual "provides" shared by salt and SUMA to guarantee that the formula works integrated with both (not at the same time). (boo#1142306) * Change the directory permission to avoid file conflicts with SUMA. - Version 0.3.0, jsc#SLE-6970 * Move to SUSE org * Add SUSE manager support - Version 0.2.2 * Support make file system after initialization * Support mount to specific folder * Add habootstrap-formula pillar/tempalte - Version 0.2.1 * Polish the README * Add travis file for auto package to obs * Change node names in example * Modify state ID to avoid conflict of other formulas - Version 0.2.0 * Add description in pillar.example. * Support more parameters in global_common.conf * Fix bugs in initial sync. * Add promote/demote state. * Use grains['host'] for primary node. salt for openSUSE Leap 15.1 received the following fixes: - Add missing 'fun' on events coming from salt-ssh wfunc executions (bsc#1151947) - Fix failing unit tests for batch async - Fix memory consumption problem on BatchAsync (bsc#1137642) - Remove wrong %endif on spec file - fix dependencies for RHEL 8 - Differentiating between markupsafe and MarkupSafe for Python3 - Prevent systemd-run description issue when running aptpkg (bsc#1152366) - Take checksums arg into account for postgres.datadir_init (bsc#1151650) - Improve batch_async to release consumed memory (bsc#1140912) - Require shadow instead of old pwdutils (bsc#1130588) - Conflict with tornado >= 5; for now we can only cope with Tornado 4.x (bsc#1101780). - Fix virt.full_info (bsc#1146382) - virt.volume_infos: silence libvirt error message - virt.volume_infos needs to ignore inactive pools - Fix for various bugs in virt network and pool states - Implement network.fqdns module function (bsc#1134860) - Strip trailing "/" from repo.uri when comparing repos in apktpkg.mod_repo (bsc#1146192) - Make python3 default for RHEL8 - Use python3 to build package Salt for RHEL8 - Fix aptpkg systemd call (bsc#1143301) - Move server_id deprecation warning to reduce log spamming (bsc#1135567) (bsc#1135732) salt was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2586=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2586=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-2586=1 Package List: - openSUSE Leap 15.1 (noarch): drbd-formula-0.3.7-lp151.2.1 habootstrap-formula-0.2.9-lp151.10.1 python2-shaptools-0.3.3-lp151.8.1 python3-shaptools-0.3.3-lp151.8.1 salt-bash-completion-2019.2.0-lp151.5.6.1 salt-fish-completion-2019.2.0-lp151.5.6.1 salt-shaptools-0.2.3-lp151.5.1 salt-zsh-completion-2019.2.0-lp151.5.6.1 saphanabootstrap-formula-0.3.2-lp151.10.1 - openSUSE Leap 15.1 (x86_64): python2-salt-2019.2.0-lp151.5.6.1 python3-salt-2019.2.0-lp151.5.6.1 salt-2019.2.0-lp151.5.6.1 salt-api-2019.2.0-lp151.5.6.1 salt-cloud-2019.2.0-lp151.5.6.1 salt-doc-2019.2.0-lp151.5.6.1 salt-master-2019.2.0-lp151.5.6.1 salt-minion-2019.2.0-lp151.5.6.1 salt-proxy-2019.2.0-lp151.5.6.1 salt-ssh-2019.2.0-lp151.5.6.1 salt-standalone-formulas-configuration-2019.2.0-lp151.5.6.1 salt-syndic-2019.2.0-lp151.5.6.1 - openSUSE Leap 15.0 (noarch): drbd-formula-0.3.7-lp150.2.1 habootstrap-formula-0.2.9-lp150.9.1 python2-shaptools-0.3.3-lp150.8.1 python3-shaptools-0.3.3-lp150.8.1 salt-shaptools-0.2.3-lp150.5.1 saphanabootstrap-formula-0.3.2-lp150.9.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): drbd-formula-0.3.7-2.1 habootstrap-formula-0.2.9-9.1 python-shaptools-0.3.3-8.1 python3-shaptools-0.3.3-8.1 salt-shaptools-0.2.3-5.1 saphanabootstrap-formula-0.3.2-9.1 References: https://bugzilla.suse.com/1101780 https://bugzilla.suse.com/1130588 https://bugzilla.suse.com/1134860 https://bugzilla.suse.com/1135567 https://bugzilla.suse.com/1135732 https://bugzilla.suse.com/1137642 https://bugzilla.suse.com/1137989 https://bugzilla.suse.com/1140912 https://bugzilla.suse.com/1142306 https://bugzilla.suse.com/1142762 https://bugzilla.suse.com/1143301 https://bugzilla.suse.com/1146192 https://bugzilla.suse.com/1146382 https://bugzilla.suse.com/1151650 https://bugzilla.suse.com/1151947 https://bugzilla.suse.com/1152366

1 0

openSUSE-RU-2019:2589-1: moderate: Recommended update for python-M2Crypto
by maintenance＠opensuse.org 30 Nov '19

30 Nov '19

openSUSE Recommended Update: Recommended update for python-M2Crypto ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2589-1 Rating: moderate References: #1149792 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-M2Crypto fixes the following issues: - Fix compatibility with OpenSSL 1.1.1c (bsc#1149792) - Upgrade OpenSSL (jsc#SLE-9135) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2589=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): python-M2Crypto-debuginfo-0.35.2-lp150.2.6.1 python-M2Crypto-debugsource-0.35.2-lp150.2.6.1 python2-M2Crypto-0.35.2-lp150.2.6.1 python2-M2Crypto-debuginfo-0.35.2-lp150.2.6.1 python3-M2Crypto-0.35.2-lp150.2.6.1 python3-M2Crypto-debuginfo-0.35.2-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): python-M2Crypto-doc-0.35.2-lp150.2.6.1 References: https://bugzilla.suse.com/1149792

1 0

openSUSE-SU-2019:2587-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 30 Nov '19

30 Nov '19

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2587-1 Rating: important References: #1155321 #1156318 Cross-References: CVE-2019-8551 CVE-2019-8558 CVE-2019-8559 CVE-2019-8563 CVE-2019-8625 CVE-2019-8674 CVE-2019-8681 CVE-2019-8684 CVE-2019-8686 CVE-2019-8687 CVE-2019-8688 CVE-2019-8689 CVE-2019-8690 CVE-2019-8707 CVE-2019-8710 CVE-2019-8719 CVE-2019-8720 CVE-2019-8726 CVE-2019-8733 CVE-2019-8735 CVE-2019-8743 CVE-2019-8763 CVE-2019-8764 CVE-2019-8765 CVE-2019-8766 CVE-2019-8768 CVE-2019-8769 CVE-2019-8771 CVE-2019-8782 CVE-2019-8783 CVE-2019-8808 CVE-2019-8811 CVE-2019-8812 CVE-2019-8813 CVE-2019-8814 CVE-2019-8815 CVE-2019-8816 CVE-2019-8819 CVE-2019-8820 CVE-2019-8821 CVE-2019-8822 CVE-2019-8823 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 42 vulnerabilities is now available. Description: This update for webkit2gtk3 to version 2.26.2 fixes the following issues: Webkit2gtk3 was updated to version 2.26.2 (WSA-2019-0005 and WSA-2019-0006, bsc#1155321 bsc#1156318) Security issues addressed: - CVE-2019-8625: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8674: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8707: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8719: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8720: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8726: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8733: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8735: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8763: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8768: Fixed an issue where a user may be unable to delete browsing history items. - CVE-2019-8769: Fixed an issue where a maliciously crafted website may reveal browsing history. - CVE-2019-8771: Fixed an issue where a maliciously crafted web content may violate iframe sandboxing policy. - CVE-2019-8710: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8743: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8764: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8765: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8766: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8782: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8783: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8808: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8811: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8812: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8813: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2019-8814: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8815: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8816: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8819: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8820: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8821: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8822: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8823: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2587=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.26.2-lp150.2.28.1 libjavascriptcoregtk-4_0-18-debuginfo-2.26.2-lp150.2.28.1 libwebkit2gtk-4_0-37-2.26.2-lp150.2.28.1 libwebkit2gtk-4_0-37-debuginfo-2.26.2-lp150.2.28.1 typelib-1_0-JavaScriptCore-4_0-2.26.2-lp150.2.28.1 typelib-1_0-WebKit2-4_0-2.26.2-lp150.2.28.1 typelib-1_0-WebKit2WebExtension-4_0-2.26.2-lp150.2.28.1 webkit-jsc-4-2.26.2-lp150.2.28.1 webkit-jsc-4-debuginfo-2.26.2-lp150.2.28.1 webkit2gtk-4_0-injected-bundles-2.26.2-lp150.2.28.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.26.2-lp150.2.28.1 webkit2gtk3-debugsource-2.26.2-lp150.2.28.1 webkit2gtk3-devel-2.26.2-lp150.2.28.1 webkit2gtk3-minibrowser-2.26.2-lp150.2.28.1 webkit2gtk3-minibrowser-debuginfo-2.26.2-lp150.2.28.1 - openSUSE Leap 15.0 (noarch): libwebkit2gtk3-lang-2.26.2-lp150.2.28.1 - openSUSE Leap 15.0 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.26.2-lp150.2.28.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.26.2-lp150.2.28.1 libwebkit2gtk-4_0-37-32bit-2.26.2-lp150.2.28.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.26.2-lp150.2.28.1 References: https://www.suse.com/security/cve/CVE-2019-8551.html https://www.suse.com/security/cve/CVE-2019-8558.html https://www.suse.com/security/cve/CVE-2019-8559.html https://www.suse.com/security/cve/CVE-2019-8563.html https://www.suse.com/security/cve/CVE-2019-8625.html https://www.suse.com/security/cve/CVE-2019-8674.html https://www.suse.com/security/cve/CVE-2019-8681.html https://www.suse.com/security/cve/CVE-2019-8684.html https://www.suse.com/security/cve/CVE-2019-8686.html https://www.suse.com/security/cve/CVE-2019-8687.html https://www.suse.com/security/cve/CVE-2019-8688.html https://www.suse.com/security/cve/CVE-2019-8689.html https://www.suse.com/security/cve/CVE-2019-8690.html https://www.suse.com/security/cve/CVE-2019-8707.html https://www.suse.com/security/cve/CVE-2019-8710.html https://www.suse.com/security/cve/CVE-2019-8719.html https://www.suse.com/security/cve/CVE-2019-8720.html https://www.suse.com/security/cve/CVE-2019-8726.html https://www.suse.com/security/cve/CVE-2019-8733.html https://www.suse.com/security/cve/CVE-2019-8735.html https://www.suse.com/security/cve/CVE-2019-8743.html https://www.suse.com/security/cve/CVE-2019-8763.html https://www.suse.com/security/cve/CVE-2019-8764.html https://www.suse.com/security/cve/CVE-2019-8765.html https://www.suse.com/security/cve/CVE-2019-8766.html https://www.suse.com/security/cve/CVE-2019-8768.html https://www.suse.com/security/cve/CVE-2019-8769.html https://www.suse.com/security/cve/CVE-2019-8771.html https://www.suse.com/security/cve/CVE-2019-8782.html https://www.suse.com/security/cve/CVE-2019-8783.html https://www.suse.com/security/cve/CVE-2019-8808.html https://www.suse.com/security/cve/CVE-2019-8811.html https://www.suse.com/security/cve/CVE-2019-8812.html https://www.suse.com/security/cve/CVE-2019-8813.html https://www.suse.com/security/cve/CVE-2019-8814.html https://www.suse.com/security/cve/CVE-2019-8815.html https://www.suse.com/security/cve/CVE-2019-8816.html https://www.suse.com/security/cve/CVE-2019-8819.html https://www.suse.com/security/cve/CVE-2019-8820.html https://www.suse.com/security/cve/CVE-2019-8821.html https://www.suse.com/security/cve/CVE-2019-8822.html https://www.suse.com/security/cve/CVE-2019-8823.html https://bugzilla.suse.com/1155321 https://bugzilla.suse.com/1156318

1 0