October 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:2282-1: moderate: Security update for jasper
by opensuse-security＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Security Update: Security update for jasper ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2282-1 Rating: moderate References: #1117507 #1117508 Cross-References: CVE-2018-19540 CVE-2018-19541 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for jasper fixes the following issues: Security issues fixed: - CVE-2018-19540: Fixed a heap based overflow in jas_icctxtdesc_input (bsc#1117508). - CVE-2018-19541: Fix heap based overread in jas_image_depalettize (bsc#1117507). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2282=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): jasper-2.0.14-lp151.4.3.1 jasper-debuginfo-2.0.14-lp151.4.3.1 jasper-debugsource-2.0.14-lp151.4.3.1 libjasper-devel-2.0.14-lp151.4.3.1 libjasper4-2.0.14-lp151.4.3.1 libjasper4-debuginfo-2.0.14-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): libjasper4-32bit-2.0.14-lp151.4.3.1 libjasper4-32bit-debuginfo-2.0.14-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-19540.html https://www.suse.com/security/cve/CVE-2018-19541.html https://bugzilla.suse.com/1117507 https://bugzilla.suse.com/1117508 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2283-1: moderate: Security update for libseccomp
by opensuse-security＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Security Update: Security update for libseccomp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2283-1 Rating: moderate References: #1082318 #1128828 #1142614 Cross-References: CVE-2019-9893 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for libseccomp fixes the following issues: Security issues fixed: - CVE-2019-9893: An incorrect generation of syscall filters in libseccomp was fixed (bsc#1128828) libseccomp was updated to new upstream release 2.4.1: - Fix a BPF generation bug where the optimizer mistakenly identified duplicate BPF code blocks. libseccomp was updated to 2.4.0 (bsc#1128828 CVE-2019-9893): - Update the syscall table for Linux v5.0-rc5 - Added support for the SCMP_ACT_KILL_PROCESS action - Added support for the SCMP_ACT_LOG action and SCMP_FLTATR_CTL_LOG attribute - Added explicit 32-bit (SCMP_AX_32(...)) and 64-bit (SCMP_AX_64(...)) argument comparison macros to help protect against unexpected sign extension - Added support for the parisc and parisc64 architectures - Added the ability to query and set the libseccomp API level via seccomp_api_get(3) and seccomp_api_set(3) - Return -EDOM on an endian mismatch when adding an architecture to a filter - Renumber the pseudo syscall number for subpage_prot() so it no longer conflicts with spu_run() - Fix PFC generation when a syscall is prioritized, but no rule exists - Numerous fixes to the seccomp-bpf filter generation code - Switch our internal hashing function to jhash/Lookup3 to MurmurHash3 - Numerous tests added to the included test suite, coverage now at ~92% - Update our Travis CI configuration to use Ubuntu 16.04 - Numerous documentation fixes and updates libseccomp was updated to release 2.3.3: - Updated the syscall table for Linux v4.15-rc7 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2283=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libseccomp-debugsource-2.4.1-lp151.3.3.1 libseccomp-devel-2.4.1-lp151.3.3.1 libseccomp-tools-2.4.1-lp151.3.3.1 libseccomp-tools-debuginfo-2.4.1-lp151.3.3.1 libseccomp2-2.4.1-lp151.3.3.1 libseccomp2-debuginfo-2.4.1-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libseccomp2-32bit-2.4.1-lp151.3.3.1 libseccomp2-32bit-debuginfo-2.4.1-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-9893.html https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1128828 https://bugzilla.suse.com/1142614 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2276-1: moderate: Security update for putty
by opensuse-security＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Security Update: Security update for putty ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2276-1 Rating: moderate References: #1152753 Cross-References: CVE-2019-17068 CVE-2019-17069 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for putty to version 0.73 fixes the following issues: Security issues fixed: - CVE-2019-17068: Fixed the insufficient handling of terminal escape sequences, that should delimit the pasted data in bracketed paste mode (boo#1152753). - CVE-2019-17069: Fixed a possible information leak caused by SSH-1 disconnection messages (boo#1152753). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2276=1 Package List: - openSUSE Leap 15.0 (x86_64): putty-0.73-lp150.18.1 putty-debuginfo-0.73-lp150.18.1 putty-debugsource-0.73-lp150.18.1 References: https://www.suse.com/security/cve/CVE-2019-17068.html https://www.suse.com/security/cve/CVE-2019-17069.html https://bugzilla.suse.com/1152753 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2277-1: moderate: Security update for putty
by opensuse-security＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Security Update: Security update for putty ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2277-1 Rating: moderate References: #1152753 Cross-References: CVE-2019-17068 CVE-2019-17069 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for putty to version 0.73 fixes the following issues: - CVE-2019-17068: Fixed the insufficient handling of terminal escape sequences, that should delimit the pasted data in bracketed paste mode (boo#1152753). - CVE-2019-17069: Fixed a possible information leak caused by SSH-1 disconnection messages (boo#1152753). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2277=1 Package List: - openSUSE Leap 15.1 (x86_64): putty-0.73-lp151.3.6.1 putty-debuginfo-0.73-lp151.3.6.1 putty-debugsource-0.73-lp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-17068.html https://www.suse.com/security/cve/CVE-2019-17069.html https://bugzilla.suse.com/1152753 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2271-1: important: Security update for php7
by opensuse-security＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2271-1 Rating: important References: #1145095 #1146360 #1151793 Cross-References: CVE-2019-11041 CVE-2019-11042 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for php7 fixes the following issues: Security issues fixed: - CVE-2019-11041: Fixed heap buffer over-read in exif_scan_thumbnail() (bsc#1146360). - CVE-2019-11042: Fixed heap buffer over-read in exif_process_user_comment() (bsc#1145095). Non-security issue fixed: - Drop -n from php invocation from pecl (bsc#1151793). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2271=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): apache2-mod_php7-7.2.5-lp150.2.25.1 apache2-mod_php7-debuginfo-7.2.5-lp150.2.25.1 php7-7.2.5-lp150.2.25.1 php7-bcmath-7.2.5-lp150.2.25.1 php7-bcmath-debuginfo-7.2.5-lp150.2.25.1 php7-bz2-7.2.5-lp150.2.25.1 php7-bz2-debuginfo-7.2.5-lp150.2.25.1 php7-calendar-7.2.5-lp150.2.25.1 php7-calendar-debuginfo-7.2.5-lp150.2.25.1 php7-ctype-7.2.5-lp150.2.25.1 php7-ctype-debuginfo-7.2.5-lp150.2.25.1 php7-curl-7.2.5-lp150.2.25.1 php7-curl-debuginfo-7.2.5-lp150.2.25.1 php7-dba-7.2.5-lp150.2.25.1 php7-dba-debuginfo-7.2.5-lp150.2.25.1 php7-debuginfo-7.2.5-lp150.2.25.1 php7-debugsource-7.2.5-lp150.2.25.1 php7-devel-7.2.5-lp150.2.25.1 php7-dom-7.2.5-lp150.2.25.1 php7-dom-debuginfo-7.2.5-lp150.2.25.1 php7-embed-7.2.5-lp150.2.25.1 php7-embed-debuginfo-7.2.5-lp150.2.25.1 php7-enchant-7.2.5-lp150.2.25.1 php7-enchant-debuginfo-7.2.5-lp150.2.25.1 php7-exif-7.2.5-lp150.2.25.1 php7-exif-debuginfo-7.2.5-lp150.2.25.1 php7-fastcgi-7.2.5-lp150.2.25.1 php7-fastcgi-debuginfo-7.2.5-lp150.2.25.1 php7-fileinfo-7.2.5-lp150.2.25.1 php7-fileinfo-debuginfo-7.2.5-lp150.2.25.1 php7-firebird-7.2.5-lp150.2.25.1 php7-firebird-debuginfo-7.2.5-lp150.2.25.1 php7-fpm-7.2.5-lp150.2.25.1 php7-fpm-debuginfo-7.2.5-lp150.2.25.1 php7-ftp-7.2.5-lp150.2.25.1 php7-ftp-debuginfo-7.2.5-lp150.2.25.1 php7-gd-7.2.5-lp150.2.25.1 php7-gd-debuginfo-7.2.5-lp150.2.25.1 php7-gettext-7.2.5-lp150.2.25.1 php7-gettext-debuginfo-7.2.5-lp150.2.25.1 php7-gmp-7.2.5-lp150.2.25.1 php7-gmp-debuginfo-7.2.5-lp150.2.25.1 php7-iconv-7.2.5-lp150.2.25.1 php7-iconv-debuginfo-7.2.5-lp150.2.25.1 php7-intl-7.2.5-lp150.2.25.1 php7-intl-debuginfo-7.2.5-lp150.2.25.1 php7-json-7.2.5-lp150.2.25.1 php7-json-debuginfo-7.2.5-lp150.2.25.1 php7-ldap-7.2.5-lp150.2.25.1 php7-ldap-debuginfo-7.2.5-lp150.2.25.1 php7-mbstring-7.2.5-lp150.2.25.1 php7-mbstring-debuginfo-7.2.5-lp150.2.25.1 php7-mysql-7.2.5-lp150.2.25.1 php7-mysql-debuginfo-7.2.5-lp150.2.25.1 php7-odbc-7.2.5-lp150.2.25.1 php7-odbc-debuginfo-7.2.5-lp150.2.25.1 php7-opcache-7.2.5-lp150.2.25.1 php7-opcache-debuginfo-7.2.5-lp150.2.25.1 php7-openssl-7.2.5-lp150.2.25.1 php7-openssl-debuginfo-7.2.5-lp150.2.25.1 php7-pcntl-7.2.5-lp150.2.25.1 php7-pcntl-debuginfo-7.2.5-lp150.2.25.1 php7-pdo-7.2.5-lp150.2.25.1 php7-pdo-debuginfo-7.2.5-lp150.2.25.1 php7-pgsql-7.2.5-lp150.2.25.1 php7-pgsql-debuginfo-7.2.5-lp150.2.25.1 php7-phar-7.2.5-lp150.2.25.1 php7-phar-debuginfo-7.2.5-lp150.2.25.1 php7-posix-7.2.5-lp150.2.25.1 php7-posix-debuginfo-7.2.5-lp150.2.25.1 php7-readline-7.2.5-lp150.2.25.1 php7-readline-debuginfo-7.2.5-lp150.2.25.1 php7-shmop-7.2.5-lp150.2.25.1 php7-shmop-debuginfo-7.2.5-lp150.2.25.1 php7-snmp-7.2.5-lp150.2.25.1 php7-snmp-debuginfo-7.2.5-lp150.2.25.1 php7-soap-7.2.5-lp150.2.25.1 php7-soap-debuginfo-7.2.5-lp150.2.25.1 php7-sockets-7.2.5-lp150.2.25.1 php7-sockets-debuginfo-7.2.5-lp150.2.25.1 php7-sodium-7.2.5-lp150.2.25.1 php7-sodium-debuginfo-7.2.5-lp150.2.25.1 php7-sqlite-7.2.5-lp150.2.25.1 php7-sqlite-debuginfo-7.2.5-lp150.2.25.1 php7-sysvmsg-7.2.5-lp150.2.25.1 php7-sysvmsg-debuginfo-7.2.5-lp150.2.25.1 php7-sysvsem-7.2.5-lp150.2.25.1 php7-sysvsem-debuginfo-7.2.5-lp150.2.25.1 php7-sysvshm-7.2.5-lp150.2.25.1 php7-sysvshm-debuginfo-7.2.5-lp150.2.25.1 php7-tidy-7.2.5-lp150.2.25.1 php7-tidy-debuginfo-7.2.5-lp150.2.25.1 php7-tokenizer-7.2.5-lp150.2.25.1 php7-tokenizer-debuginfo-7.2.5-lp150.2.25.1 php7-wddx-7.2.5-lp150.2.25.1 php7-wddx-debuginfo-7.2.5-lp150.2.25.1 php7-xmlreader-7.2.5-lp150.2.25.1 php7-xmlreader-debuginfo-7.2.5-lp150.2.25.1 php7-xmlrpc-7.2.5-lp150.2.25.1 php7-xmlrpc-debuginfo-7.2.5-lp150.2.25.1 php7-xmlwriter-7.2.5-lp150.2.25.1 php7-xmlwriter-debuginfo-7.2.5-lp150.2.25.1 php7-xsl-7.2.5-lp150.2.25.1 php7-xsl-debuginfo-7.2.5-lp150.2.25.1 php7-zip-7.2.5-lp150.2.25.1 php7-zip-debuginfo-7.2.5-lp150.2.25.1 php7-zlib-7.2.5-lp150.2.25.1 php7-zlib-debuginfo-7.2.5-lp150.2.25.1 - openSUSE Leap 15.0 (noarch): php7-pear-7.2.5-lp150.2.25.1 php7-pear-Archive_Tar-7.2.5-lp150.2.25.1 References: https://www.suse.com/security/cve/CVE-2019-11041.html https://www.suse.com/security/cve/CVE-2019-11042.html https://bugzilla.suse.com/1145095 https://bugzilla.suse.com/1146360 https://bugzilla.suse.com/1151793 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2263-1: important: Security update for bind
by opensuse-security＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2263-1 Rating: important References: #1118367 #1118368 #1138687 Cross-References: CVE-2019-6471 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for bind fixes the following issues: Security issue fixed: - CVE-2019-6471: Fixed a reachable assert in dispatch.c. (bsc#1138687) Non-security issue fixed: - bind will no longer rely on /etc/insserv.conf (bsc#1118367, bsc#1118368) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2263=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): bind-9.11.2-lp150.8.16.1 bind-chrootenv-9.11.2-lp150.8.16.1 bind-debuginfo-9.11.2-lp150.8.16.1 bind-debugsource-9.11.2-lp150.8.16.1 bind-devel-9.11.2-lp150.8.16.1 bind-lwresd-9.11.2-lp150.8.16.1 bind-lwresd-debuginfo-9.11.2-lp150.8.16.1 bind-utils-9.11.2-lp150.8.16.1 bind-utils-debuginfo-9.11.2-lp150.8.16.1 libbind9-160-9.11.2-lp150.8.16.1 libbind9-160-debuginfo-9.11.2-lp150.8.16.1 libdns169-9.11.2-lp150.8.16.1 libdns169-debuginfo-9.11.2-lp150.8.16.1 libirs-devel-9.11.2-lp150.8.16.1 libirs160-9.11.2-lp150.8.16.1 libirs160-debuginfo-9.11.2-lp150.8.16.1 libisc166-9.11.2-lp150.8.16.1 libisc166-debuginfo-9.11.2-lp150.8.16.1 libisccc160-9.11.2-lp150.8.16.1 libisccc160-debuginfo-9.11.2-lp150.8.16.1 libisccfg160-9.11.2-lp150.8.16.1 libisccfg160-debuginfo-9.11.2-lp150.8.16.1 liblwres160-9.11.2-lp150.8.16.1 liblwres160-debuginfo-9.11.2-lp150.8.16.1 - openSUSE Leap 15.0 (noarch): bind-doc-9.11.2-lp150.8.16.1 python3-bind-9.11.2-lp150.8.16.1 - openSUSE Leap 15.0 (x86_64): bind-devel-32bit-9.11.2-lp150.8.16.1 libbind9-160-32bit-9.11.2-lp150.8.16.1 libbind9-160-32bit-debuginfo-9.11.2-lp150.8.16.1 libdns169-32bit-9.11.2-lp150.8.16.1 libdns169-32bit-debuginfo-9.11.2-lp150.8.16.1 libirs160-32bit-9.11.2-lp150.8.16.1 libirs160-32bit-debuginfo-9.11.2-lp150.8.16.1 libisc166-32bit-9.11.2-lp150.8.16.1 libisc166-32bit-debuginfo-9.11.2-lp150.8.16.1 libisccc160-32bit-9.11.2-lp150.8.16.1 libisccc160-32bit-debuginfo-9.11.2-lp150.8.16.1 libisccfg160-32bit-9.11.2-lp150.8.16.1 libisccfg160-32bit-debuginfo-9.11.2-lp150.8.16.1 liblwres160-32bit-9.11.2-lp150.8.16.1 liblwres160-32bit-debuginfo-9.11.2-lp150.8.16.1 References: https://www.suse.com/security/cve/CVE-2019-6471.html https://bugzilla.suse.com/1118367 https://bugzilla.suse.com/1118368 https://bugzilla.suse.com/1138687 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2260-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2260-1 Rating: important References: #1109465 #1117473 #1123482 #1124525 #1133810 #1138688 #1140868 #1141322 #1145665 #1149292 #1149293 #1149294 #1149295 #1149296 #1149297 #1149298 #1149299 #1149302 #1149303 #1149304 #1149323 Cross-References: CVE-2019-11710 CVE-2019-11714 CVE-2019-11716 CVE-2019-11718 CVE-2019-11720 CVE-2019-11721 CVE-2019-11723 CVE-2019-11724 CVE-2019-11725 CVE-2019-11727 CVE-2019-11728 CVE-2019-11733 CVE-2019-11735 CVE-2019-11736 CVE-2019-11738 CVE-2019-11740 CVE-2019-11742 CVE-2019-11743 CVE-2019-11744 CVE-2019-11746 CVE-2019-11747 CVE-2019-11748 CVE-2019-11749 CVE-2019-11750 CVE-2019-11751 CVE-2019-11752 CVE-2019-11753 CVE-2019-9811 CVE-2019-9812 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 29 vulnerabilities is now available. Description: This update for MozillaFirefox to 68.1 fixes the following issues: Security issues fixed: - CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868) - CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294) - CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868) - CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868) - CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868) - CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868) - CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868) - CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868) - CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868) - CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868) - CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868) - CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322) - CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868) - CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665) - CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293) - CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292) - CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302) - CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299) - CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303) - CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298) - CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304) - CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297) - CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296) - CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295) Non-security issues fixed: - Latest update now also released for s390x. (bsc#1109465) - Fixed a segmentation fault on s390vsl082. (bsc#1117473) - Fixed a crash on SLES15 s390x. (bsc#1124525) - Fixed a segmentation fault. (bsc#1133810) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2260=1 Package List: - openSUSE Leap 15.0 (x86_64): MozillaFirefox-68.1.0-lp150.3.66.1 MozillaFirefox-branding-upstream-68.1.0-lp150.3.66.1 MozillaFirefox-buildsymbols-68.1.0-lp150.3.66.1 MozillaFirefox-debuginfo-68.1.0-lp150.3.66.1 MozillaFirefox-debugsource-68.1.0-lp150.3.66.1 MozillaFirefox-devel-68.1.0-lp150.3.66.1 MozillaFirefox-translations-common-68.1.0-lp150.3.66.1 MozillaFirefox-translations-other-68.1.0-lp150.3.66.1 References: https://www.suse.com/security/cve/CVE-2019-11710.html https://www.suse.com/security/cve/CVE-2019-11714.html https://www.suse.com/security/cve/CVE-2019-11716.html https://www.suse.com/security/cve/CVE-2019-11718.html https://www.suse.com/security/cve/CVE-2019-11720.html https://www.suse.com/security/cve/CVE-2019-11721.html https://www.suse.com/security/cve/CVE-2019-11723.html https://www.suse.com/security/cve/CVE-2019-11724.html https://www.suse.com/security/cve/CVE-2019-11725.html https://www.suse.com/security/cve/CVE-2019-11727.html https://www.suse.com/security/cve/CVE-2019-11728.html https://www.suse.com/security/cve/CVE-2019-11733.html https://www.suse.com/security/cve/CVE-2019-11735.html https://www.suse.com/security/cve/CVE-2019-11736.html https://www.suse.com/security/cve/CVE-2019-11738.html https://www.suse.com/security/cve/CVE-2019-11740.html https://www.suse.com/security/cve/CVE-2019-11742.html https://www.suse.com/security/cve/CVE-2019-11743.html https://www.suse.com/security/cve/CVE-2019-11744.html https://www.suse.com/security/cve/CVE-2019-11746.html https://www.suse.com/security/cve/CVE-2019-11747.html https://www.suse.com/security/cve/CVE-2019-11748.html https://www.suse.com/security/cve/CVE-2019-11749.html https://www.suse.com/security/cve/CVE-2019-11750.html https://www.suse.com/security/cve/CVE-2019-11751.html https://www.suse.com/security/cve/CVE-2019-11752.html https://www.suse.com/security/cve/CVE-2019-11753.html https://www.suse.com/security/cve/CVE-2019-9811.html https://www.suse.com/security/cve/CVE-2019-9812.html https://bugzilla.suse.com/1109465 https://bugzilla.suse.com/1117473 https://bugzilla.suse.com/1123482 https://bugzilla.suse.com/1124525 https://bugzilla.suse.com/1133810 https://bugzilla.suse.com/1138688 https://bugzilla.suse.com/1140868 https://bugzilla.suse.com/1141322 https://bugzilla.suse.com/1145665 https://bugzilla.suse.com/1149292 https://bugzilla.suse.com/1149293 https://bugzilla.suse.com/1149294 https://bugzilla.suse.com/1149295 https://bugzilla.suse.com/1149296 https://bugzilla.suse.com/1149297 https://bugzilla.suse.com/1149298 https://bugzilla.suse.com/1149299 https://bugzilla.suse.com/1149302 https://bugzilla.suse.com/1149303 https://bugzilla.suse.com/1149304 https://bugzilla.suse.com/1149323 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2269-1: moderate: Security update for openssl-1_0_0
by opensuse-security＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Security Update: Security update for openssl-1_0_0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2269-1 Rating: moderate References: #1131291 #1150003 #1150250 Cross-References: CVE-2019-1547 CVE-2019-1563 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for openssl-1_0_0 fixes the following issues: OpenSSL Security Advisory [10 September 2019] * CVE-2019-1547: Added EC_GROUP_set_generator side channel attack avoidance. (bsc#1150003) * CVE-2019-1563: Fixed Bleichenbacher attack against cms/pkcs7 encryption transported key (bsc#1150250) In addition fixed invalid curve attacks by validating that an EC point lies on the curve (bsc#1131291). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2269=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libopenssl-1_0_0-devel-1.0.2p-lp151.5.10.1 libopenssl1_0_0-1.0.2p-lp151.5.10.1 libopenssl1_0_0-debuginfo-1.0.2p-lp151.5.10.1 libopenssl1_0_0-hmac-1.0.2p-lp151.5.10.1 libopenssl1_0_0-steam-1.0.2p-lp151.5.10.1 libopenssl1_0_0-steam-debuginfo-1.0.2p-lp151.5.10.1 openssl-1_0_0-1.0.2p-lp151.5.10.1 openssl-1_0_0-cavs-1.0.2p-lp151.5.10.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-lp151.5.10.1 openssl-1_0_0-debuginfo-1.0.2p-lp151.5.10.1 openssl-1_0_0-debugsource-1.0.2p-lp151.5.10.1 - openSUSE Leap 15.1 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-lp151.5.10.1 libopenssl1_0_0-32bit-1.0.2p-lp151.5.10.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-lp151.5.10.1 libopenssl1_0_0-hmac-32bit-1.0.2p-lp151.5.10.1 libopenssl1_0_0-steam-32bit-1.0.2p-lp151.5.10.1 libopenssl1_0_0-steam-32bit-debuginfo-1.0.2p-lp151.5.10.1 - openSUSE Leap 15.1 (noarch): openssl-1_0_0-doc-1.0.2p-lp151.5.10.1 References: https://www.suse.com/security/cve/CVE-2019-1547.html https://www.suse.com/security/cve/CVE-2019-1563.html https://bugzilla.suse.com/1131291 https://bugzilla.suse.com/1150003 https://bugzilla.suse.com/1150250 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2259-1: moderate: Security update for python-numpy
by opensuse-security＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Security Update: Security update for python-numpy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2259-1 Rating: moderate References: #1149203 Cross-References: CVE-2019-6446 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-numpy fixes the following issues: Non-security issues fixed: - Updated to upstream version 1.16.1. (bsc#1149203) (jsc#SLE-8532) This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2259=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): python2-numpy_1_16_1-gnu-hpc-1.16.1-bp151.2.3.1 python2-numpy_1_16_1-gnu-hpc-devel-1.16.1-bp151.2.3.1 python3-numpy_1_16_1-gnu-hpc-1.16.1-bp151.2.3.1 python3-numpy_1_16_1-gnu-hpc-devel-1.16.1-bp151.2.3.1 - openSUSE Backports SLE-15-SP1 (ppc64le s390x): python2-numpy-gnu-hpc-1.16.1-bp151.2.3.1 python2-numpy-gnu-hpc-devel-1.16.1-bp151.2.3.1 python3-numpy-gnu-hpc-1.16.1-bp151.2.3.1 python3-numpy-gnu-hpc-devel-1.16.1-bp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-6446.html https://bugzilla.suse.com/1149203 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2264-1: moderate: Security update for nginx
by opensuse-security＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Security Update: Security update for nginx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2264-1 Rating: moderate References: #1145579 #1145580 #1145582 Cross-References: CVE-2019-9511 CVE-2019-9513 CVE-2019-9516 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nginx fixes the following issues: Security issues fixed: - CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579). - CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580). - CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2264=1 Package List: - openSUSE Leap 15.0 (x86_64): nginx-1.14.2-lp150.2.11.1 nginx-debuginfo-1.14.2-lp150.2.11.1 nginx-debugsource-1.14.2-lp150.2.11.1 - openSUSE Leap 15.0 (noarch): vim-plugin-nginx-1.14.2-lp150.2.11.1 References: https://www.suse.com/security/cve/CVE-2019-9511.html https://www.suse.com/security/cve/CVE-2019-9513.html https://www.suse.com/security/cve/CVE-2019-9516.html https://bugzilla.suse.com/1145579 https://bugzilla.suse.com/1145580 https://bugzilla.suse.com/1145582 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2265-1: important: Security update for bind
by opensuse-security＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2265-1 Rating: important References: #1118367 #1118368 #1138687 Cross-References: CVE-2019-6471 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for bind fixes the following issues: Security issue fixed: - CVE-2019-6471: Fixed a reachable assert in dispatch.c. (bsc#1138687) Non-security issue fixed: - bind will no longer rely on /etc/insserv.conf (bsc#1118367, bsc#1118368) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2265=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): bind-9.11.2-lp151.11.6.1 bind-chrootenv-9.11.2-lp151.11.6.1 bind-debuginfo-9.11.2-lp151.11.6.1 bind-debugsource-9.11.2-lp151.11.6.1 bind-devel-9.11.2-lp151.11.6.1 bind-lwresd-9.11.2-lp151.11.6.1 bind-lwresd-debuginfo-9.11.2-lp151.11.6.1 bind-utils-9.11.2-lp151.11.6.1 bind-utils-debuginfo-9.11.2-lp151.11.6.1 libbind9-160-9.11.2-lp151.11.6.1 libbind9-160-debuginfo-9.11.2-lp151.11.6.1 libdns169-9.11.2-lp151.11.6.1 libdns169-debuginfo-9.11.2-lp151.11.6.1 libirs-devel-9.11.2-lp151.11.6.1 libirs160-9.11.2-lp151.11.6.1 libirs160-debuginfo-9.11.2-lp151.11.6.1 libisc166-9.11.2-lp151.11.6.1 libisc166-debuginfo-9.11.2-lp151.11.6.1 libisccc160-9.11.2-lp151.11.6.1 libisccc160-debuginfo-9.11.2-lp151.11.6.1 libisccfg160-9.11.2-lp151.11.6.1 libisccfg160-debuginfo-9.11.2-lp151.11.6.1 liblwres160-9.11.2-lp151.11.6.1 liblwres160-debuginfo-9.11.2-lp151.11.6.1 - openSUSE Leap 15.1 (x86_64): bind-devel-32bit-9.11.2-lp151.11.6.1 libbind9-160-32bit-9.11.2-lp151.11.6.1 libbind9-160-32bit-debuginfo-9.11.2-lp151.11.6.1 libdns169-32bit-9.11.2-lp151.11.6.1 libdns169-32bit-debuginfo-9.11.2-lp151.11.6.1 libirs160-32bit-9.11.2-lp151.11.6.1 libirs160-32bit-debuginfo-9.11.2-lp151.11.6.1 libisc166-32bit-9.11.2-lp151.11.6.1 libisc166-32bit-debuginfo-9.11.2-lp151.11.6.1 libisccc160-32bit-9.11.2-lp151.11.6.1 libisccc160-32bit-debuginfo-9.11.2-lp151.11.6.1 libisccfg160-32bit-9.11.2-lp151.11.6.1 libisccfg160-32bit-debuginfo-9.11.2-lp151.11.6.1 liblwres160-32bit-9.11.2-lp151.11.6.1 liblwres160-32bit-debuginfo-9.11.2-lp151.11.6.1 - openSUSE Leap 15.1 (noarch): bind-doc-9.11.2-lp151.11.6.1 python3-bind-9.11.2-lp151.11.6.1 References: https://www.suse.com/security/cve/CVE-2019-6471.html https://bugzilla.suse.com/1118367 https://bugzilla.suse.com/1118368 https://bugzilla.suse.com/1138687 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2268-1: moderate: Security update for openssl-1_0_0
by opensuse-security＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Security Update: Security update for openssl-1_0_0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2268-1 Rating: moderate References: #1131291 #1150003 #1150250 Cross-References: CVE-2019-1547 CVE-2019-1563 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for openssl-1_0_0 fixes the following issues: OpenSSL Security Advisory [10 September 2019] * CVE-2019-1547: Added EC_GROUP_set_generator side channel attack avoidance. (bsc#1150003) * CVE-2019-1563: Fixed Bleichenbacher attack against cms/pkcs7 encryption transported key (bsc#1150250) In addition fixed invalid curve attacks by validating that an EC point lies on the curve (bsc#1131291). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2268=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libopenssl-1_0_0-devel-1.0.2p-lp150.2.19.1 libopenssl1_0_0-1.0.2p-lp150.2.19.1 libopenssl1_0_0-debuginfo-1.0.2p-lp150.2.19.1 libopenssl1_0_0-hmac-1.0.2p-lp150.2.19.1 libopenssl1_0_0-steam-1.0.2p-lp150.2.19.1 libopenssl1_0_0-steam-debuginfo-1.0.2p-lp150.2.19.1 openssl-1_0_0-1.0.2p-lp150.2.19.1 openssl-1_0_0-cavs-1.0.2p-lp150.2.19.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-lp150.2.19.1 openssl-1_0_0-debuginfo-1.0.2p-lp150.2.19.1 openssl-1_0_0-debugsource-1.0.2p-lp150.2.19.1 - openSUSE Leap 15.0 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-lp150.2.19.1 libopenssl1_0_0-32bit-1.0.2p-lp150.2.19.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-lp150.2.19.1 libopenssl1_0_0-hmac-32bit-1.0.2p-lp150.2.19.1 libopenssl1_0_0-steam-32bit-1.0.2p-lp150.2.19.1 libopenssl1_0_0-steam-32bit-debuginfo-1.0.2p-lp150.2.19.1 - openSUSE Leap 15.0 (noarch): openssl-1_0_0-doc-1.0.2p-lp150.2.19.1 References: https://www.suse.com/security/cve/CVE-2019-1547.html https://www.suse.com/security/cve/CVE-2019-1563.html https://bugzilla.suse.com/1131291 https://bugzilla.suse.com/1150003 https://bugzilla.suse.com/1150250 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2251-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 05 Oct '19

05 Oct '19

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2251-1 Rating: important References: #1109465 #1117473 #1123482 #1124525 #1133810 #1138688 #1140868 #1141322 #1145665 #1149292 #1149293 #1149294 #1149295 #1149296 #1149297 #1149298 #1149299 #1149302 #1149303 #1149304 #1149323 Cross-References: CVE-2019-11710 CVE-2019-11714 CVE-2019-11716 CVE-2019-11718 CVE-2019-11720 CVE-2019-11721 CVE-2019-11723 CVE-2019-11724 CVE-2019-11725 CVE-2019-11727 CVE-2019-11728 CVE-2019-11733 CVE-2019-11735 CVE-2019-11736 CVE-2019-11738 CVE-2019-11740 CVE-2019-11742 CVE-2019-11743 CVE-2019-11744 CVE-2019-11746 CVE-2019-11747 CVE-2019-11748 CVE-2019-11749 CVE-2019-11750 CVE-2019-11751 CVE-2019-11752 CVE-2019-11753 CVE-2019-9811 CVE-2019-9812 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 29 vulnerabilities is now available. Description: This update for MozillaFirefox to 68.1 fixes the following issues: Security issues fixed: - CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868) - CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294) - CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868) - CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868) - CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868) - CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868) - CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868) - CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868) - CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868) - CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868) - CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868) - CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322) - CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868) - CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665) - CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293) - CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292) - CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302) - CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299) - CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303) - CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298) - CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304) - CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297) - CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296) - CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295) Non-security issues fixed: - Latest update now also released for s390x. (bsc#1109465) - Fixed a segmentation fault on s390vsl082. (bsc#1117473) - Fixed a crash on SLES15 s390x. (bsc#1124525) - Fixed a segmentation fault. (bsc#1133810) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2251=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaFirefox-68.1.0-lp151.2.14.1 MozillaFirefox-branding-upstream-68.1.0-lp151.2.14.1 MozillaFirefox-buildsymbols-68.1.0-lp151.2.14.1 MozillaFirefox-debuginfo-68.1.0-lp151.2.14.1 MozillaFirefox-debugsource-68.1.0-lp151.2.14.1 MozillaFirefox-devel-68.1.0-lp151.2.14.1 MozillaFirefox-translations-common-68.1.0-lp151.2.14.1 MozillaFirefox-translations-other-68.1.0-lp151.2.14.1 References: https://www.suse.com/security/cve/CVE-2019-11710.html https://www.suse.com/security/cve/CVE-2019-11714.html https://www.suse.com/security/cve/CVE-2019-11716.html https://www.suse.com/security/cve/CVE-2019-11718.html https://www.suse.com/security/cve/CVE-2019-11720.html https://www.suse.com/security/cve/CVE-2019-11721.html https://www.suse.com/security/cve/CVE-2019-11723.html https://www.suse.com/security/cve/CVE-2019-11724.html https://www.suse.com/security/cve/CVE-2019-11725.html https://www.suse.com/security/cve/CVE-2019-11727.html https://www.suse.com/security/cve/CVE-2019-11728.html https://www.suse.com/security/cve/CVE-2019-11733.html https://www.suse.com/security/cve/CVE-2019-11735.html https://www.suse.com/security/cve/CVE-2019-11736.html https://www.suse.com/security/cve/CVE-2019-11738.html https://www.suse.com/security/cve/CVE-2019-11740.html https://www.suse.com/security/cve/CVE-2019-11742.html https://www.suse.com/security/cve/CVE-2019-11743.html https://www.suse.com/security/cve/CVE-2019-11744.html https://www.suse.com/security/cve/CVE-2019-11746.html https://www.suse.com/security/cve/CVE-2019-11747.html https://www.suse.com/security/cve/CVE-2019-11748.html https://www.suse.com/security/cve/CVE-2019-11749.html https://www.suse.com/security/cve/CVE-2019-11750.html https://www.suse.com/security/cve/CVE-2019-11751.html https://www.suse.com/security/cve/CVE-2019-11752.html https://www.suse.com/security/cve/CVE-2019-11753.html https://www.suse.com/security/cve/CVE-2019-9811.html https://www.suse.com/security/cve/CVE-2019-9812.html https://bugzilla.suse.com/1109465 https://bugzilla.suse.com/1117473 https://bugzilla.suse.com/1123482 https://bugzilla.suse.com/1124525 https://bugzilla.suse.com/1133810 https://bugzilla.suse.com/1138688 https://bugzilla.suse.com/1140868 https://bugzilla.suse.com/1141322 https://bugzilla.suse.com/1145665 https://bugzilla.suse.com/1149292 https://bugzilla.suse.com/1149293 https://bugzilla.suse.com/1149294 https://bugzilla.suse.com/1149295 https://bugzilla.suse.com/1149296 https://bugzilla.suse.com/1149297 https://bugzilla.suse.com/1149298 https://bugzilla.suse.com/1149299 https://bugzilla.suse.com/1149302 https://bugzilla.suse.com/1149303 https://bugzilla.suse.com/1149304 https://bugzilla.suse.com/1149323 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2248-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 04 Oct '19

04 Oct '19

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2248-1 Rating: important References: #1140868 #1141322 #1149296 #1149297 #1149298 #1149299 #1149303 #1149304 #1150939 #1152375 Cross-References: CVE-2019-11709 CVE-2019-11710 CVE-2019-11711 CVE-2019-11712 CVE-2019-11713 CVE-2019-11714 CVE-2019-11715 CVE-2019-11716 CVE-2019-11717 CVE-2019-11719 CVE-2019-11720 CVE-2019-11721 CVE-2019-11723 CVE-2019-11724 CVE-2019-11725 CVE-2019-11727 CVE-2019-11728 CVE-2019-11729 CVE-2019-11730 CVE-2019-11739 CVE-2019-11740 CVE-2019-11742 CVE-2019-11743 CVE-2019-11744 CVE-2019-11746 CVE-2019-11752 CVE-2019-11755 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 68.1.1 fixes the following issues: - CVE-2019-11709: Fixed several memory safety bugs. (bsc#1140868) - CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868) - CVE-2019-11711: Fixed a script injection within domain through inner window reuse. (bsc#1140868) - CVE-2019-11712: Fixed an insufficient validation of cross-origin POST requests within NPAPI plugins. (bsc#1140868) - CVE-2019-11713: Fixed a use-after-free with HTTP/2 cached stream. (bsc#1140868) - CVE-2019-11714: Fixed a crash in NeckoChild. (bsc#1140868) - CVE-2019-11715: Fixed an HTML parsing error that can contribute to content XSS. (bsc#1140868) - CVE-2019-11716: Fixed an enumeration issue in globalThis. (bsc#1140868) - CVE-2019-11717: Fixed an improper escaping of the caret character in origins. (bsc#1140868) - CVE-2019-11719: Fixed an out-of-bounds read when importing curve25519 private key. (bsc#1140868) - CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868) - CVE-2019-11721: Fixed domain spoofing through unicode latin 'kra' character. (bsc#1140868) - CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868) - CVE-2019-11724: Fixed a permissions issue with the retired site input.mozilla.org. (bsc#1140868) - CVE-2019-11725: Fixed a SafeBrowsing bypass through WebSockets. (bsc#1140868) - CVE-2019-11727: Fixed an insufficient validation for PKCS#1 v1.5 signatures being used with TLS 1.3. (bsc#1140868) - CVE-2019-11728: Fixed port scanning through Alt-Svc header. (bsc#1140868) - CVE-2019-11729: Fixed a segmentation fault due to empty or malformed p256-ECDH public keys. (bsc#1140868) - CVE-2019-11730: Fixed an insufficient enforcement of the same-origin policy that treats all files in a directory as having the same-origin. (bsc#1140868) - CVE-2019-11739: Fixed a Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message. (bsc#1150939) - CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299) - CVE-2019-11742: Fixed a same-origin policy violation with SVG filters and canvas that enabled theft of cross-origin images. (bsc#1149303) - CVE-2019-11743: Fixed a cross-origin access issue. (bsc#1149298) - CVE-2019-11744: Fixed a XSS involving breaking out of title and textarea elements using innerHTML. (bsc#1149304) - CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297) - CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296) - CVE-2019-11755: Fixed an insufficient validation of S/MIME messages that allowed the author to be spoofed. (bsc#1152375) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2248=1 Package List: - openSUSE Leap 15.0 (x86_64): MozillaThunderbird-68.1.1-lp150.3.51.1 MozillaThunderbird-buildsymbols-68.1.1-lp150.3.51.1 MozillaThunderbird-debuginfo-68.1.1-lp150.3.51.1 MozillaThunderbird-debugsource-68.1.1-lp150.3.51.1 MozillaThunderbird-translations-common-68.1.1-lp150.3.51.1 MozillaThunderbird-translations-other-68.1.1-lp150.3.51.1 enigmail-2.1.2-lp150.34.1 References: https://www.suse.com/security/cve/CVE-2019-11709.html https://www.suse.com/security/cve/CVE-2019-11710.html https://www.suse.com/security/cve/CVE-2019-11711.html https://www.suse.com/security/cve/CVE-2019-11712.html https://www.suse.com/security/cve/CVE-2019-11713.html https://www.suse.com/security/cve/CVE-2019-11714.html https://www.suse.com/security/cve/CVE-2019-11715.html https://www.suse.com/security/cve/CVE-2019-11716.html https://www.suse.com/security/cve/CVE-2019-11717.html https://www.suse.com/security/cve/CVE-2019-11719.html https://www.suse.com/security/cve/CVE-2019-11720.html https://www.suse.com/security/cve/CVE-2019-11721.html https://www.suse.com/security/cve/CVE-2019-11723.html https://www.suse.com/security/cve/CVE-2019-11724.html https://www.suse.com/security/cve/CVE-2019-11725.html https://www.suse.com/security/cve/CVE-2019-11727.html https://www.suse.com/security/cve/CVE-2019-11728.html https://www.suse.com/security/cve/CVE-2019-11729.html https://www.suse.com/security/cve/CVE-2019-11730.html https://www.suse.com/security/cve/CVE-2019-11739.html https://www.suse.com/security/cve/CVE-2019-11740.html https://www.suse.com/security/cve/CVE-2019-11742.html https://www.suse.com/security/cve/CVE-2019-11743.html https://www.suse.com/security/cve/CVE-2019-11744.html https://www.suse.com/security/cve/CVE-2019-11746.html https://www.suse.com/security/cve/CVE-2019-11752.html https://www.suse.com/security/cve/CVE-2019-11755.html https://bugzilla.suse.com/1140868 https://bugzilla.suse.com/1141322 https://bugzilla.suse.com/1149296 https://bugzilla.suse.com/1149297 https://bugzilla.suse.com/1149298 https://bugzilla.suse.com/1149299 https://bugzilla.suse.com/1149303 https://bugzilla.suse.com/1149304 https://bugzilla.suse.com/1150939 https://bugzilla.suse.com/1152375 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2249-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 04 Oct '19

04 Oct '19

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2249-1 Rating: important References: #1140868 #1141322 #1149296 #1149297 #1149298 #1149299 #1149303 #1149304 #1150939 #1152375 Cross-References: CVE-2019-11709 CVE-2019-11710 CVE-2019-11711 CVE-2019-11712 CVE-2019-11713 CVE-2019-11714 CVE-2019-11715 CVE-2019-11716 CVE-2019-11717 CVE-2019-11719 CVE-2019-11720 CVE-2019-11721 CVE-2019-11723 CVE-2019-11724 CVE-2019-11725 CVE-2019-11727 CVE-2019-11728 CVE-2019-11729 CVE-2019-11730 CVE-2019-11739 CVE-2019-11740 CVE-2019-11742 CVE-2019-11743 CVE-2019-11744 CVE-2019-11746 CVE-2019-11752 CVE-2019-11755 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 68.1.1 fixes the following issues: - CVE-2019-11709: Fixed several memory safety bugs. (bsc#1140868) - CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868) - CVE-2019-11711: Fixed a script injection within domain through inner window reuse. (bsc#1140868) - CVE-2019-11712: Fixed an insufficient validation of cross-origin POST requests within NPAPI plugins. (bsc#1140868) - CVE-2019-11713: Fixed a use-after-free with HTTP/2 cached stream. (bsc#1140868) - CVE-2019-11714: Fixed a crash in NeckoChild. (bsc#1140868) - CVE-2019-11715: Fixed an HTML parsing error that can contribute to content XSS. (bsc#1140868) - CVE-2019-11716: Fixed an enumeration issue in globalThis. (bsc#1140868) - CVE-2019-11717: Fixed an improper escaping of the caret character in origins. (bsc#1140868) - CVE-2019-11719: Fixed an out-of-bounds read when importing curve25519 private key. (bsc#1140868) - CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868) - CVE-2019-11721: Fixed domain spoofing through unicode latin 'kra' character. (bsc#1140868) - CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868) - CVE-2019-11724: Fixed a permissions issue with the retired site input.mozilla.org. (bsc#1140868) - CVE-2019-11725: Fixed a SafeBrowsing bypass through WebSockets. (bsc#1140868) - CVE-2019-11727: Fixed an insufficient validation for PKCS#1 v1.5 signatures being used with TLS 1.3. (bsc#1140868) - CVE-2019-11728: Fixed port scanning through Alt-Svc header. (bsc#1140868) - CVE-2019-11729: Fixed a segmentation fault due to empty or malformed p256-ECDH public keys. (bsc#1140868) - CVE-2019-11730: Fixed an insufficient enforcement of the same-origin policy that treats all files in a directory as having the same-origin. (bsc#1140868) - CVE-2019-11739: Fixed a Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message. (bsc#1150939) - CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299) - CVE-2019-11742: Fixed a same-origin policy violation with SVG filters and canvas that enabled theft of cross-origin images. (bsc#1149303) - CVE-2019-11743: Fixed a cross-origin access issue. (bsc#1149298) - CVE-2019-11744: Fixed a XSS involving breaking out of title and textarea elements using innerHTML. (bsc#1149304) - CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297) - CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296) - CVE-2019-11755: Fixed an insufficient validation of S/MIME messages that allowed the author to be spoofed. (bsc#1152375) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2249=1 Package List: - openSUSE Leap 15.1 (x86_64): MozillaThunderbird-68.1.1-lp151.2.13.1 MozillaThunderbird-buildsymbols-68.1.1-lp151.2.13.1 MozillaThunderbird-debuginfo-68.1.1-lp151.2.13.1 MozillaThunderbird-debugsource-68.1.1-lp151.2.13.1 MozillaThunderbird-translations-common-68.1.1-lp151.2.13.1 MozillaThunderbird-translations-other-68.1.1-lp151.2.13.1 enigmail-2.1.2-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-11709.html https://www.suse.com/security/cve/CVE-2019-11710.html https://www.suse.com/security/cve/CVE-2019-11711.html https://www.suse.com/security/cve/CVE-2019-11712.html https://www.suse.com/security/cve/CVE-2019-11713.html https://www.suse.com/security/cve/CVE-2019-11714.html https://www.suse.com/security/cve/CVE-2019-11715.html https://www.suse.com/security/cve/CVE-2019-11716.html https://www.suse.com/security/cve/CVE-2019-11717.html https://www.suse.com/security/cve/CVE-2019-11719.html https://www.suse.com/security/cve/CVE-2019-11720.html https://www.suse.com/security/cve/CVE-2019-11721.html https://www.suse.com/security/cve/CVE-2019-11723.html https://www.suse.com/security/cve/CVE-2019-11724.html https://www.suse.com/security/cve/CVE-2019-11725.html https://www.suse.com/security/cve/CVE-2019-11727.html https://www.suse.com/security/cve/CVE-2019-11728.html https://www.suse.com/security/cve/CVE-2019-11729.html https://www.suse.com/security/cve/CVE-2019-11730.html https://www.suse.com/security/cve/CVE-2019-11739.html https://www.suse.com/security/cve/CVE-2019-11740.html https://www.suse.com/security/cve/CVE-2019-11742.html https://www.suse.com/security/cve/CVE-2019-11743.html https://www.suse.com/security/cve/CVE-2019-11744.html https://www.suse.com/security/cve/CVE-2019-11746.html https://www.suse.com/security/cve/CVE-2019-11752.html https://www.suse.com/security/cve/CVE-2019-11755.html https://bugzilla.suse.com/1140868 https://bugzilla.suse.com/1141322 https://bugzilla.suse.com/1149296 https://bugzilla.suse.com/1149297 https://bugzilla.suse.com/1149298 https://bugzilla.suse.com/1149299 https://bugzilla.suse.com/1149303 https://bugzilla.suse.com/1149304 https://bugzilla.suse.com/1150939 https://bugzilla.suse.com/1152375 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2247-1: moderate: Security update for mosquitto
by opensuse-security＠opensuse.org 03 Oct '19

03 Oct '19

openSUSE Security Update: Security update for mosquitto ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2247-1 Rating: moderate References: #1151494 Cross-References: CVE-2019-11779 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mosquitto fixes the following issues: - CVE-2019-11779: Fixed insufficient parsing of SUBSCRIBE packets that could lead to a stack overflow (bsc#1151494). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2247=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libmosquitto1-1.5.7-bp151.3.3.1 libmosquittopp1-1.5.7-bp151.3.3.1 mosquitto-1.5.7-bp151.3.3.1 mosquitto-clients-1.5.7-bp151.3.3.1 mosquitto-devel-1.5.7-bp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-11779.html https://bugzilla.suse.com/1151494 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2245-1: moderate: Security update for lxc
by opensuse-security＠opensuse.org 03 Oct '19

03 Oct '19

openSUSE Security Update: Security update for lxc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2245-1 Rating: moderate References: #1131762 Cross-References: CVE-2019-5736 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lxc fixes the following issues: Update to lxc 3.2.1. The changelog can be found at https://discuss.linuxcontainers.org/t/lxc-3-2-1-has-been-released/5322 + seccomp: support syscall forwarding to userspace + add lxc.seccomp.allow_nesting + pidfd: Add initial support for the new pidfd api * Many hardening improvements. * Use /sys/kernel/cgroup/delegate file for cgroup v2. * Fix CVE-2019-5736 equivalent bug. - fix apparmor dropin to be compatible with LXC 3.1.0 (boo#1131762) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2245=1 Package List: - openSUSE Leap 15.1 (noarch): lxc-bash-completion-3.2.1-lp151.4.5.1 - openSUSE Leap 15.1 (x86_64): liblxc-devel-3.2.1-lp151.4.5.1 liblxc1-3.2.1-lp151.4.5.1 liblxc1-debuginfo-3.2.1-lp151.4.5.1 lxc-3.2.1-lp151.4.5.1 lxc-debuginfo-3.2.1-lp151.4.5.1 lxc-debugsource-3.2.1-lp151.4.5.1 pam_cgfs-3.2.1-lp151.4.5.1 pam_cgfs-debuginfo-3.2.1-lp151.4.5.1 References: https://www.suse.com/security/cve/CVE-2019-5736.html https://bugzilla.suse.com/1131762 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2244-1: moderate: Security update for rust
by opensuse-security＠opensuse.org 03 Oct '19

03 Oct '19

openSUSE Security Update: Security update for rust ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2244-1 Rating: moderate References: #1096945 #1100691 #1133283 #1134978 Cross-References: CVE-2018-1000622 CVE-2019-12083 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for rust fixes the following issues: Rust was updated to version 1.36.0. Security issues fixed: - CVE-2019-12083: a standard method can be overridden violating Rust's safety guarantees and causing memory unsafety (bsc#1134978) - CVE-2018-1000622: rustdoc loads plugins from world writable directory allowing for arbitrary code execution (bsc#1100691) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2244=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): cargo-1.36.0-lp151.5.4.2 cargo-debuginfo-1.36.0-lp151.5.4.2 clippy-1.36.0-lp151.5.4.2 clippy-debuginfo-1.36.0-lp151.5.4.2 rls-1.36.0-lp151.5.4.2 rls-debuginfo-1.36.0-lp151.5.4.2 rust-1.36.0-lp151.5.4.2 rust-analysis-1.36.0-lp151.5.4.2 rust-debuginfo-1.36.0-lp151.5.4.2 rust-debugsource-1.36.0-lp151.5.4.2 rust-doc-1.36.0-lp151.5.4.2 rust-gdb-1.36.0-lp151.5.4.2 rust-std-static-1.36.0-lp151.5.4.2 rustfmt-1.36.0-lp151.5.4.2 rustfmt-debuginfo-1.36.0-lp151.5.4.2 - openSUSE Leap 15.1 (noarch): cargo-doc-1.36.0-lp151.5.4.2 rust-src-1.36.0-lp151.5.4.2 References: https://www.suse.com/security/cve/CVE-2018-1000622.html https://www.suse.com/security/cve/CVE-2019-12083.html https://bugzilla.suse.com/1096945 https://bugzilla.suse.com/1100691 https://bugzilla.suse.com/1133283 https://bugzilla.suse.com/1134978 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2234-1: moderate: Security update for nghttp2
by opensuse-security＠opensuse.org 01 Oct '19

01 Oct '19

openSUSE Security Update: Security update for nghttp2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2234-1 Rating: moderate References: #1112438 #1125689 #1134616 #1146182 #1146184 Cross-References: CVE-2019-9511 CVE-2019-9513 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for nghttp2 fixes the following issues: Security issues fixed: - CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184). - CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#11461). Bug fixes and enhancements: - Fixed mistake in spec file (bsc#1125689) - Fixed build issue with boost 1.70.0 (bsc#1134616) - Feature: Add W&S module (FATE#326776, bsc#1112438) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2234=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libnghttp2-14-1.39.2-lp150.2.3.1 libnghttp2-14-debuginfo-1.39.2-lp150.2.3.1 libnghttp2-devel-1.39.2-lp150.2.3.1 libnghttp2_asio-devel-1.39.2-lp150.2.3.1 libnghttp2_asio1-1.39.2-lp150.2.3.1 libnghttp2_asio1-debuginfo-1.39.2-lp150.2.3.1 nghttp2-1.39.2-lp150.2.3.1 nghttp2-debuginfo-1.39.2-lp150.2.3.1 nghttp2-debugsource-1.39.2-lp150.2.3.1 nghttp2-python-debugsource-1.39.2-lp150.2.3.1 python3-nghttp2-1.39.2-lp150.2.3.1 python3-nghttp2-debuginfo-1.39.2-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libnghttp2-14-32bit-1.39.2-lp150.2.3.1 libnghttp2-14-32bit-debuginfo-1.39.2-lp150.2.3.1 libnghttp2_asio1-32bit-1.39.2-lp150.2.3.1 libnghttp2_asio1-32bit-debuginfo-1.39.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-9511.html https://www.suse.com/security/cve/CVE-2019-9513.html https://bugzilla.suse.com/1112438 https://bugzilla.suse.com/1125689 https://bugzilla.suse.com/1134616 https://bugzilla.suse.com/1146182 https://bugzilla.suse.com/1146184 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2235-1: moderate: Security update for u-boot
by opensuse-security＠opensuse.org 01 Oct '19

01 Oct '19

openSUSE Security Update: Security update for u-boot ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2235-1 Rating: moderate References: #1144656 #1144675 Cross-References: CVE-2019-13104 CVE-2019-13106 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for u-boot fixes the following issues: Security issues fixed: - CVE-2019-13106: Fixed stack buffer overflow via a crafted ext4 filesystem that may lead to code execution (bsc#1144656). - CVE-2019-13104: Fixed an underflow that could cause memcpy() to overwrite a very large amount of data via a crafted ext4 filesystem (bsc#1144675). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2235=1 Package List: - openSUSE Leap 15.0 (x86_64): u-boot-tools-2018.03-lp150.4.3.1 u-boot-tools-debuginfo-2018.03-lp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-13104.html https://www.suse.com/security/cve/CVE-2019-13106.html https://bugzilla.suse.com/1144656 https://bugzilla.suse.com/1144675 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2232-1: moderate: Security update for nghttp2
by opensuse-security＠opensuse.org 01 Oct '19

01 Oct '19

openSUSE Security Update: Security update for nghttp2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2232-1 Rating: moderate References: #1112438 #1125689 #1134616 #1146182 #1146184 Cross-References: CVE-2019-9511 CVE-2019-9513 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for nghttp2 fixes the following issues: Security issues fixed: - CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184). - CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#11461). Bug fixes and enhancements: - Fixed mistake in spec file (bsc#1125689) - Fixed build issue with boost 1.70.0 (bsc#1134616) - Feature: Add W&S module (FATE#326776, bsc#1112438) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2232=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libnghttp2-14-1.39.2-lp151.3.3.1 libnghttp2-14-debuginfo-1.39.2-lp151.3.3.1 libnghttp2-devel-1.39.2-lp151.3.3.1 libnghttp2_asio-devel-1.39.2-lp151.3.3.1 libnghttp2_asio1-1.39.2-lp151.3.3.1 libnghttp2_asio1-debuginfo-1.39.2-lp151.3.3.1 nghttp2-1.39.2-lp151.3.3.1 nghttp2-debuginfo-1.39.2-lp151.3.3.1 nghttp2-debugsource-1.39.2-lp151.3.3.1 nghttp2-python-debugsource-1.39.2-lp151.3.3.1 python3-nghttp2-1.39.2-lp151.3.3.1 python3-nghttp2-debuginfo-1.39.2-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libnghttp2-14-32bit-1.39.2-lp151.3.3.1 libnghttp2-14-32bit-debuginfo-1.39.2-lp151.3.3.1 libnghttp2_asio1-32bit-1.39.2-lp151.3.3.1 libnghttp2_asio1-32bit-debuginfo-1.39.2-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-9511.html https://www.suse.com/security/cve/CVE-2019-9513.html https://bugzilla.suse.com/1112438 https://bugzilla.suse.com/1125689 https://bugzilla.suse.com/1134616 https://bugzilla.suse.com/1146182 https://bugzilla.suse.com/1146184 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2233-1: moderate: Security update for u-boot
by opensuse-security＠opensuse.org 01 Oct '19

01 Oct '19

openSUSE Security Update: Security update for u-boot ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2233-1 Rating: moderate References: #1144656 #1144675 Cross-References: CVE-2019-13104 CVE-2019-13106 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for u-boot fixes the following issues: Security issues fixed: - CVE-2019-13106: Fixed stack buffer overflow via a crafted ext4 filesystem that may lead to code execution (bsc#1144656). - CVE-2019-13104: Fixed an underflow that could cause memcpy() to overwrite a very large amount of data via a crafted ext4 filesystem (bsc#1144675). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2233=1 Package List: - openSUSE Leap 15.1 (x86_64): u-boot-tools-2019.01-lp151.6.3.1 u-boot-tools-debuginfo-2019.01-lp151.6.3.1 References: https://www.suse.com/security/cve/CVE-2019-13104.html https://www.suse.com/security/cve/CVE-2019-13106.html https://bugzilla.suse.com/1144656 https://bugzilla.suse.com/1144675 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2228-1: important: Security update for chromium
by opensuse-security＠opensuse.org 01 Oct '19

01 Oct '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2228-1 Rating: important References: #1151229 Cross-References: CVE-2019-13685 CVE-2019-13686 CVE-2019-13687 CVE-2019-13688 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for chromium to version 77.0.3865.90 fixes the following issues: - CVE-2019-13685: Fixed a use-after-free in UI. (boo#1151229) - CVE-2019-13688: Fixed a use-after-free in media. (boo#1151229) - CVE-2019-13687: Fixed a use-after-free in media. (boo#1151229) - CVE-2019-13686: Fixed a use-after-free in offline pages. (boo#1151229) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2228=1 Package List: - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-77.0.3865.90-bp150.234.1 chromium-77.0.3865.90-bp150.234.1 References: https://www.suse.com/security/cve/CVE-2019-13685.html https://www.suse.com/security/cve/CVE-2019-13686.html https://www.suse.com/security/cve/CVE-2019-13687.html https://www.suse.com/security/cve/CVE-2019-13688.html https://bugzilla.suse.com/1151229 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2229-1: important: Security update for chromium
by opensuse-security＠opensuse.org 01 Oct '19

01 Oct '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2229-1 Rating: important References: #1151229 Cross-References: CVE-2019-13685 CVE-2019-13686 CVE-2019-13687 CVE-2019-13688 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for chromium to version 77.0.3865.90 fixes the following issues: - CVE-2019-13685: Fixed a use-after-free in UI. (boo#1151229) - CVE-2019-13688: Fixed a use-after-free in media. (boo#1151229) - CVE-2019-13687: Fixed a use-after-free in media. (boo#1151229) - CVE-2019-13686: Fixed a use-after-free in offline pages. (boo#1151229) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2229=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-77.0.3865.90-bp151.3.15.1 chromium-77.0.3865.90-bp151.3.15.1 References: https://www.suse.com/security/cve/CVE-2019-13685.html https://www.suse.com/security/cve/CVE-2019-13686.html https://www.suse.com/security/cve/CVE-2019-13687.html https://www.suse.com/security/cve/CVE-2019-13688.html https://bugzilla.suse.com/1151229 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0