October 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:2232-1: moderate: Security update for nghttp2
by opensuse-security＠opensuse.org 01 Oct '19

01 Oct '19

openSUSE Security Update: Security update for nghttp2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2232-1 Rating: moderate References: #1112438 #1125689 #1134616 #1146182 #1146184 Cross-References: CVE-2019-9511 CVE-2019-9513 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for nghttp2 fixes the following issues: Security issues fixed: - CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184). - CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#11461). Bug fixes and enhancements: - Fixed mistake in spec file (bsc#1125689) - Fixed build issue with boost 1.70.0 (bsc#1134616) - Feature: Add W&S module (FATE#326776, bsc#1112438) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2232=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libnghttp2-14-1.39.2-lp151.3.3.1 libnghttp2-14-debuginfo-1.39.2-lp151.3.3.1 libnghttp2-devel-1.39.2-lp151.3.3.1 libnghttp2_asio-devel-1.39.2-lp151.3.3.1 libnghttp2_asio1-1.39.2-lp151.3.3.1 libnghttp2_asio1-debuginfo-1.39.2-lp151.3.3.1 nghttp2-1.39.2-lp151.3.3.1 nghttp2-debuginfo-1.39.2-lp151.3.3.1 nghttp2-debugsource-1.39.2-lp151.3.3.1 nghttp2-python-debugsource-1.39.2-lp151.3.3.1 python3-nghttp2-1.39.2-lp151.3.3.1 python3-nghttp2-debuginfo-1.39.2-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libnghttp2-14-32bit-1.39.2-lp151.3.3.1 libnghttp2-14-32bit-debuginfo-1.39.2-lp151.3.3.1 libnghttp2_asio1-32bit-1.39.2-lp151.3.3.1 libnghttp2_asio1-32bit-debuginfo-1.39.2-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-9511.html https://www.suse.com/security/cve/CVE-2019-9513.html https://bugzilla.suse.com/1112438 https://bugzilla.suse.com/1125689 https://bugzilla.suse.com/1134616 https://bugzilla.suse.com/1146182 https://bugzilla.suse.com/1146184 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2233-1: moderate: Security update for u-boot
by opensuse-security＠opensuse.org 01 Oct '19

01 Oct '19

openSUSE Security Update: Security update for u-boot ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2233-1 Rating: moderate References: #1144656 #1144675 Cross-References: CVE-2019-13104 CVE-2019-13106 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for u-boot fixes the following issues: Security issues fixed: - CVE-2019-13106: Fixed stack buffer overflow via a crafted ext4 filesystem that may lead to code execution (bsc#1144656). - CVE-2019-13104: Fixed an underflow that could cause memcpy() to overwrite a very large amount of data via a crafted ext4 filesystem (bsc#1144675). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2233=1 Package List: - openSUSE Leap 15.1 (x86_64): u-boot-tools-2019.01-lp151.6.3.1 u-boot-tools-debuginfo-2019.01-lp151.6.3.1 References: https://www.suse.com/security/cve/CVE-2019-13104.html https://www.suse.com/security/cve/CVE-2019-13106.html https://bugzilla.suse.com/1144656 https://bugzilla.suse.com/1144675 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2228-1: important: Security update for chromium
by opensuse-security＠opensuse.org 01 Oct '19

01 Oct '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2228-1 Rating: important References: #1151229 Cross-References: CVE-2019-13685 CVE-2019-13686 CVE-2019-13687 CVE-2019-13688 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for chromium to version 77.0.3865.90 fixes the following issues: - CVE-2019-13685: Fixed a use-after-free in UI. (boo#1151229) - CVE-2019-13688: Fixed a use-after-free in media. (boo#1151229) - CVE-2019-13687: Fixed a use-after-free in media. (boo#1151229) - CVE-2019-13686: Fixed a use-after-free in offline pages. (boo#1151229) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2228=1 Package List: - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-77.0.3865.90-bp150.234.1 chromium-77.0.3865.90-bp150.234.1 References: https://www.suse.com/security/cve/CVE-2019-13685.html https://www.suse.com/security/cve/CVE-2019-13686.html https://www.suse.com/security/cve/CVE-2019-13687.html https://www.suse.com/security/cve/CVE-2019-13688.html https://bugzilla.suse.com/1151229 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2229-1: important: Security update for chromium
by opensuse-security＠opensuse.org 01 Oct '19

01 Oct '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2229-1 Rating: important References: #1151229 Cross-References: CVE-2019-13685 CVE-2019-13686 CVE-2019-13687 CVE-2019-13688 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for chromium to version 77.0.3865.90 fixes the following issues: - CVE-2019-13685: Fixed a use-after-free in UI. (boo#1151229) - CVE-2019-13688: Fixed a use-after-free in media. (boo#1151229) - CVE-2019-13687: Fixed a use-after-free in media. (boo#1151229) - CVE-2019-13686: Fixed a use-after-free in offline pages. (boo#1151229) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2229=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-77.0.3865.90-bp151.3.15.1 chromium-77.0.3865.90-bp151.3.15.1 References: https://www.suse.com/security/cve/CVE-2019-13685.html https://www.suse.com/security/cve/CVE-2019-13686.html https://www.suse.com/security/cve/CVE-2019-13687.html https://www.suse.com/security/cve/CVE-2019-13688.html https://bugzilla.suse.com/1151229 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0