October 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:2300-1: moderate: Security update for sqlite3
by opensuse-security＠opensuse.org 08 Oct '19

08 Oct '19

openSUSE Security Update: Security update for sqlite3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2300-1 Rating: moderate References: #1150137 Cross-References: CVE-2019-16168 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for sqlite3 fixes the following issues: Security issue fixed: - CVE-2019-16168: Fixed improper validation of sqlite_stat1 field that could lead to denial of service (bsc#1150137). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2300=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libsqlite3-0-3.28.0-lp151.2.3.1 libsqlite3-0-debuginfo-3.28.0-lp151.2.3.1 sqlite3-3.28.0-lp151.2.3.1 sqlite3-debuginfo-3.28.0-lp151.2.3.1 sqlite3-debugsource-3.28.0-lp151.2.3.1 sqlite3-devel-3.28.0-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): libsqlite3-0-32bit-3.28.0-lp151.2.3.1 libsqlite3-0-32bit-debuginfo-3.28.0-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): sqlite3-doc-3.28.0-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-16168.html https://bugzilla.suse.com/1150137 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2298-1: moderate: Security update for sqlite3
by opensuse-security＠opensuse.org 08 Oct '19

08 Oct '19

openSUSE Security Update: Security update for sqlite3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2298-1 Rating: moderate References: #1150137 Cross-References: CVE-2019-16168 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for sqlite3 fixes the following issues: Security issue fixed: - CVE-2019-16168: Fixed improper validation of sqlite_stat1 field that could lead to denial of service (bsc#1150137). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2298=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libsqlite3-0-3.28.0-lp150.2.9.1 libsqlite3-0-debuginfo-3.28.0-lp150.2.9.1 sqlite3-3.28.0-lp150.2.9.1 sqlite3-debuginfo-3.28.0-lp150.2.9.1 sqlite3-debugsource-3.28.0-lp150.2.9.1 sqlite3-devel-3.28.0-lp150.2.9.1 - openSUSE Leap 15.0 (x86_64): libsqlite3-0-32bit-3.28.0-lp150.2.9.1 libsqlite3-0-32bit-debuginfo-3.28.0-lp150.2.9.1 - openSUSE Leap 15.0 (noarch): sqlite3-doc-3.28.0-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2019-16168.html https://bugzilla.suse.com/1150137 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2294-1: moderate: Security update for rust
by opensuse-security＠opensuse.org 08 Oct '19

08 Oct '19

openSUSE Security Update: Security update for rust ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2294-1 Rating: moderate References: #1096945 #1100691 #1133283 #1134978 Cross-References: CVE-2018-1000622 CVE-2019-12083 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for rust fixes the following issues: Rust was updated to version 1.36.0. Security issues fixed: - CVE-2019-12083: a standard method can be overridden violating Rust's safety guarantees and causing memory unsafety (bsc#1134978) - CVE-2018-1000622: rustdoc loads plugins from world writable directory allowing for arbitrary code execution (bsc#1100691) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2294=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): cargo-1.36.0-lp151.5.8.1 cargo-debuginfo-1.36.0-lp151.5.8.1 clippy-1.36.0-lp151.5.8.1 clippy-debuginfo-1.36.0-lp151.5.8.1 rls-1.36.0-lp151.5.8.1 rls-debuginfo-1.36.0-lp151.5.8.1 rust-1.36.0-lp151.5.8.1 rust-analysis-1.36.0-lp151.5.8.1 rust-debuginfo-1.36.0-lp151.5.8.1 rust-debugsource-1.36.0-lp151.5.8.1 rust-doc-1.36.0-lp151.5.8.1 rust-gdb-1.36.0-lp151.5.8.1 rust-std-static-1.36.0-lp151.5.8.1 rustfmt-1.36.0-lp151.5.8.1 rustfmt-debuginfo-1.36.0-lp151.5.8.1 - openSUSE Leap 15.1 (x86_64): rust-cbindgen-0.8.7-lp151.5.2 rust-cbindgen-debuginfo-0.8.7-lp151.5.2 - openSUSE Leap 15.1 (noarch): cargo-doc-1.36.0-lp151.5.8.1 rust-src-1.36.0-lp151.5.8.1 References: https://www.suse.com/security/cve/CVE-2018-1000622.html https://www.suse.com/security/cve/CVE-2019-12083.html https://bugzilla.suse.com/1096945 https://bugzilla.suse.com/1100691 https://bugzilla.suse.com/1133283 https://bugzilla.suse.com/1134978 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2292-1: moderate: Security update for putty
by opensuse-security＠opensuse.org 08 Oct '19

08 Oct '19

openSUSE Security Update: Security update for putty ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2292-1 Rating: moderate References: #1152753 Cross-References: CVE-2019-17068 CVE-2019-17069 Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for putty to version 0.73 fixes the following issues: Security issues fixed: - CVE-2019-17068: Fixed the insufficient handling of terminal escape sequences, that should delimit the pasted data in bracketed paste mode (boo#1152753). - CVE-2019-17069: Fixed a possible information leak caused by SSH-1 disconnection messages (boo#1152753). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2292=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2292=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): putty-0.73-bp151.4.6.1 putty-debuginfo-0.73-bp151.4.6.1 putty-debugsource-0.73-bp151.4.6.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): putty-0.73-bp150.4.12.1 References: https://www.suse.com/security/cve/CVE-2019-17068.html https://www.suse.com/security/cve/CVE-2019-17069.html https://bugzilla.suse.com/1152753 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2286-1: moderate: Security update for lxc
by opensuse-security＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Security Update: Security update for lxc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2286-1 Rating: moderate References: #1131762 Cross-References: CVE-2019-5736 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lxc fixes the following issues: Update to lxc 3.2.1. The changelog can be found at https://discuss.linuxcontainers.org/t/lxc-3-2-1-has-been-released/5322 + seccomp: support syscall forwarding to userspace + add lxc.seccomp.allow_nesting + pidfd: Add initial support for the new pidfd api * Many hardening improvements. * Use /sys/kernel/cgroup/delegate file for cgroup v2. * Fix CVE-2019-5736 equivalent bug. - fix apparmor dropin to be compatible with LXC 3.1.0 (boo#1131762) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2286=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): liblxc-devel-3.2.1-bp151.5.3.1 liblxc1-3.2.1-bp151.5.3.1 lxc-3.2.1-bp151.5.3.1 pam_cgfs-3.2.1-bp151.5.3.1 - openSUSE Backports SLE-15-SP1 (noarch): lxc-bash-completion-3.2.1-bp151.5.3.1 References: https://www.suse.com/security/cve/CVE-2019-5736.html https://bugzilla.suse.com/1131762 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2288-1: moderate: Security update for singularity
by opensuse-security＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Security Update: Security update for singularity ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2288-1 Rating: moderate References: #1125369 #1128598 Cross-References: CVE-2019-11328 Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for singularity fixes the following issues: singularity was updated to version 3.4.1: This point release addresses the following issues: - Fixes an issue where a PID namespace was always being used - Fixes compilation on non 64-bit architectures - Allows fakeroot builds for zypper, pacstrap, and debootstrap - Correctly detects seccomp on OpenSUSE - Honors GO_MODFLAGS properly in the mconfig generated makefile - Passes the Mac hostname to the VM in MacOS Singularity builds - Handles temporary EAGAIN failures when setting up loop devices on recent kernels. New version 3.4.0. Many changes since 3.2.1, for the full changelog please read CHANGELOG.md Update to version 3.2.1: This point release fixes the following bugs: - Allows users to join instances with non-suid workflow - Removes false warning when seccomp is disabled on the host - Fixes an issue in the terminal when piping output to commands - Binds NVIDIA persistenced socket when `--nv` is invoked Improve integration with SUSE Products: add support to create Singularity images with SLE. * Newer SUSE versions use a different path for the RPM database. * When the installation succeeds by an installation scriptlet fails zypper returns error code 107. Don't treat this as an error. * In order to specify a repository GPG key, add support for multi line variables. * In order to specify a list of additional repos, add support to 'indexed' variables. * Improve handling of SUSE repositires: - For SLE, use SUSEConnect to get all product repos. - Allow to specify a repository GPG key. - Allow to specify additional installation repositories. - Add group 'singularity', fix ownerships. Updated to singularity v3.2.0 * CVE-2019-11328: Instance files are now stored in user's home directory for privacy and many checks have been added to ensure that a user can't manipulate files to change `starter-suid` behavior when instances are joined (many thanks to Matthias Gerstner from the SUSE security team for finding and securely reporting this vulnerability) (boo#1128598) * New features / functionalities - Introduced a new basic framework for creating and managing plugins - Added the ability to create containers through multi-stage builds - Created the concept of a Sylabs Cloud "remote" endpoint and added the ability for users and admins to set them through CLI and conf files - Added caching for images from Singularity Hub - Made it possible to compile Singularity outside of `$GOPATH` - Added a json partition to SIF files for OCI configuration when building from an OCI source - Full integration with Singularity desktop for MacOS code base * New Commands - Introduced the `plugin` command group for creating and managing plugins. * Introduced the `remote` command group to support management of Singularity endpoints. * Added to the `key` command group to improve PGP key management. * Added the `Stage: <name>` keyword to the definition file header and the `from <stage name>` option/argument pair to the `%files` section to support multistage builds * Deprecated / removed commands - The `--token/-t` option has been deprecated in favor of the `singularity remote` command group * Changed defaults / behaviors - Ask to confirm password on a newly generated PGP key - Prompt to push a key to the KeyStore when generated - Refuse to push an unsigned container unless overridden with `--allow-unauthenticated/-U` option - Warn and prompt when pulling an unsigned container without the `--allow-unauthenticated/-U` option For more information check: https://github.com/sylabs/singularity/blob/release-3.2/CHANGELOG.md Updated to singularity v3.1.1: * New Commands - New hidden `buildcfg` command to display compile-time parameters - Added support for `LDFLAGS`, `CFLAGS`, `CGO_` variables in build system - Added `--nocolor` flag to Singularity client to disable color in logging * Removed Commands - `singularity capability <add/drop> --desc` has been removed - `singularity capability list <--all/--group/--user>` flags have all been removed * New features / functionalities - The `--builder` flag to the `build` command implicitly sets `--remote` - Repeated binds no longer cause Singularity to exit and fail, just warn instead - Corrected typos and improved docstrings throughout - Removed warning when CWD does not exist on the host system - Added support to spec file for RPM building on SLES 11 Update to singularity 3.1.0 what is reimplementaion in go so this is a complete new build and just reusing the changelog entries, following build differences were made to the upstream spec file * build position independent executable * build stripped executable - Change from /var/singularity to /var/lib/singularity - Fix warning on bash-completion file about non-executible script. - Add bash completions directory to file list for suse_version < 1500 to keep the build checker happy. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2288=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2288=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): singularity-3.4.1-bp151.3.3.1 singularity-debuginfo-3.4.1-bp151.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): singularity-3.4.1-bp150.2.10.1 References: https://www.suse.com/security/cve/CVE-2019-11328.html https://bugzilla.suse.com/1125369 https://bugzilla.suse.com/1128598 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2280-1: moderate: Security update for libseccomp
by opensuse-security＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Security Update: Security update for libseccomp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2280-1 Rating: moderate References: #1082318 #1128828 #1142614 Cross-References: CVE-2019-9893 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for libseccomp fixes the following issues: Security issues fixed: - CVE-2019-9893: An incorrect generation of syscall filters in libseccomp was fixed (bsc#1128828) libseccomp was updated to new upstream release 2.4.1: - Fix a BPF generation bug where the optimizer mistakenly identified duplicate BPF code blocks. libseccomp was updated to 2.4.0 (bsc#1128828 CVE-2019-9893): - Update the syscall table for Linux v5.0-rc5 - Added support for the SCMP_ACT_KILL_PROCESS action - Added support for the SCMP_ACT_LOG action and SCMP_FLTATR_CTL_LOG attribute - Added explicit 32-bit (SCMP_AX_32(...)) and 64-bit (SCMP_AX_64(...)) argument comparison macros to help protect against unexpected sign extension - Added support for the parisc and parisc64 architectures - Added the ability to query and set the libseccomp API level via seccomp_api_get(3) and seccomp_api_set(3) - Return -EDOM on an endian mismatch when adding an architecture to a filter - Renumber the pseudo syscall number for subpage_prot() so it no longer conflicts with spu_run() - Fix PFC generation when a syscall is prioritized, but no rule exists - Numerous fixes to the seccomp-bpf filter generation code - Switch our internal hashing function to jhash/Lookup3 to MurmurHash3 - Numerous tests added to the included test suite, coverage now at ~92% - Update our Travis CI configuration to use Ubuntu 16.04 - Numerous documentation fixes and updates libseccomp was updated to release 2.3.3: - Updated the syscall table for Linux v4.15-rc7 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2280=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libseccomp-debugsource-2.4.1-lp150.2.3.1 libseccomp-devel-2.4.1-lp150.2.3.1 libseccomp-tools-2.4.1-lp150.2.3.1 libseccomp-tools-debuginfo-2.4.1-lp150.2.3.1 libseccomp2-2.4.1-lp150.2.3.1 libseccomp2-debuginfo-2.4.1-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libseccomp2-32bit-2.4.1-lp150.2.3.1 libseccomp2-32bit-debuginfo-2.4.1-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-9893.html https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1128828 https://bugzilla.suse.com/1142614 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2281-1: important: Security update for dovecot23
by opensuse-security＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Security Update: Security update for dovecot23 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2281-1 Rating: important References: #1133624 #1133625 #1145559 Cross-References: CVE-2019-11494 CVE-2019-11499 CVE-2019-11500 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for dovecot23 fixes the following issues: - CVE-2019-11500: Fixed the NUL byte handling in IMAP and ManageSieve protocol parsers. (bsc#1145559) - CVE-2019-11499: Fixed a vulnerability where the submission-login would crash over a TLS secured channel (bsc#1133625). - CVE-2019-11494: Fixed a denial of service if the authentication is aborted by disconnecting (bsc#1133624). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2281=1 Package List: - openSUSE Leap 15.1 (x86_64): dovecot23-2.3.3-lp151.2.6.1 dovecot23-backend-mysql-2.3.3-lp151.2.6.1 dovecot23-backend-mysql-debuginfo-2.3.3-lp151.2.6.1 dovecot23-backend-pgsql-2.3.3-lp151.2.6.1 dovecot23-backend-pgsql-debuginfo-2.3.3-lp151.2.6.1 dovecot23-backend-sqlite-2.3.3-lp151.2.6.1 dovecot23-backend-sqlite-debuginfo-2.3.3-lp151.2.6.1 dovecot23-debuginfo-2.3.3-lp151.2.6.1 dovecot23-debugsource-2.3.3-lp151.2.6.1 dovecot23-devel-2.3.3-lp151.2.6.1 dovecot23-fts-2.3.3-lp151.2.6.1 dovecot23-fts-debuginfo-2.3.3-lp151.2.6.1 dovecot23-fts-lucene-2.3.3-lp151.2.6.1 dovecot23-fts-lucene-debuginfo-2.3.3-lp151.2.6.1 dovecot23-fts-solr-2.3.3-lp151.2.6.1 dovecot23-fts-solr-debuginfo-2.3.3-lp151.2.6.1 dovecot23-fts-squat-2.3.3-lp151.2.6.1 dovecot23-fts-squat-debuginfo-2.3.3-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-11494.html https://www.suse.com/security/cve/CVE-2019-11499.html https://www.suse.com/security/cve/CVE-2019-11500.html https://bugzilla.suse.com/1133624 https://bugzilla.suse.com/1133625 https://bugzilla.suse.com/1145559 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2279-1: moderate: Security update for jasper
by opensuse-security＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Security Update: Security update for jasper ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2279-1 Rating: moderate References: #1117507 #1117508 Cross-References: CVE-2018-19540 CVE-2018-19541 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for jasper fixes the following issues: Security issues fixed: - CVE-2018-19540: Fixed a heap based overflow in jas_icctxtdesc_input (bsc#1117508). - CVE-2018-19541: Fix heap based overread in jas_image_depalettize (bsc#1117507). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2279=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): jasper-2.0.14-lp150.2.6.1 jasper-debuginfo-2.0.14-lp150.2.6.1 jasper-debugsource-2.0.14-lp150.2.6.1 libjasper-devel-2.0.14-lp150.2.6.1 libjasper4-2.0.14-lp150.2.6.1 libjasper4-debuginfo-2.0.14-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libjasper4-32bit-2.0.14-lp150.2.6.1 libjasper4-32bit-debuginfo-2.0.14-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-19540.html https://www.suse.com/security/cve/CVE-2018-19541.html https://bugzilla.suse.com/1117507 https://bugzilla.suse.com/1117508 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2278-1: important: Security update for dovecot23
by opensuse-security＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Security Update: Security update for dovecot23 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2278-1 Rating: important References: #1133624 #1133625 #1145559 Cross-References: CVE-2019-11494 CVE-2019-11499 CVE-2019-11500 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for dovecot23 fixes the following issue: - CVE-2019-11500: Fixed the NUL byte handling in IMAP and ManageSieve protocol parsers. (bsc#1145559) - CVE-2019-11499: Fixed a vulnerability where the submission-login would crash over a TLS secured channel (bsc#1133625). - CVE-2019-11494: Fixed a denial of service if the authentication is aborted by disconnecting (bsc#1133624). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2278=1 Package List: - openSUSE Leap 15.0 (x86_64): dovecot23-2.3.3-lp150.14.1 dovecot23-backend-mysql-2.3.3-lp150.14.1 dovecot23-backend-mysql-debuginfo-2.3.3-lp150.14.1 dovecot23-backend-pgsql-2.3.3-lp150.14.1 dovecot23-backend-pgsql-debuginfo-2.3.3-lp150.14.1 dovecot23-backend-sqlite-2.3.3-lp150.14.1 dovecot23-backend-sqlite-debuginfo-2.3.3-lp150.14.1 dovecot23-debuginfo-2.3.3-lp150.14.1 dovecot23-debugsource-2.3.3-lp150.14.1 dovecot23-devel-2.3.3-lp150.14.1 dovecot23-fts-2.3.3-lp150.14.1 dovecot23-fts-debuginfo-2.3.3-lp150.14.1 dovecot23-fts-lucene-2.3.3-lp150.14.1 dovecot23-fts-lucene-debuginfo-2.3.3-lp150.14.1 dovecot23-fts-solr-2.3.3-lp150.14.1 dovecot23-fts-solr-debuginfo-2.3.3-lp150.14.1 dovecot23-fts-squat-2.3.3-lp150.14.1 dovecot23-fts-squat-debuginfo-2.3.3-lp150.14.1 References: https://www.suse.com/security/cve/CVE-2019-11494.html https://www.suse.com/security/cve/CVE-2019-11499.html https://www.suse.com/security/cve/CVE-2019-11500.html https://bugzilla.suse.com/1133624 https://bugzilla.suse.com/1133625 https://bugzilla.suse.com/1145559 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0