November 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:2494-1: moderate: Security update for gdb
by opensuse-security＠opensuse.org 12 Nov '19

12 Nov '19

openSUSE Security Update: Security update for gdb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2494-1 Rating: moderate References: #1115034 #1142772 #1145692 Cross-References: CVE-2019-1010180 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for gdb fixes the following issues: Update to gdb 8.3.1: (jsc#ECO-368) Security issues fixed: - CVE-2019-1010180: Fixed a potential buffer overflow when loading ELF sections larger than the file. (bsc#1142772) Upgrade libipt from v2.0 to v2.0.1. - Enable librpm for version > librpm.so.3 [bsc#1145692]: * Allow any librpm.so.x * Add %build test to check for "zypper install <rpm-packagename>" message - Copy gdbinit from fedora master @ 25caf28. Add gdbinit.without-python, and use it for --without=python. Rebase to 8.3 release (as in fedora 30 @ 1e222a3). * DWARF index cache: GDB can now automatically save indices of DWARF symbols on disk to speed up further loading of the same binaries. * Ada task switching is now supported on aarch64-elf targets when debugging a program using the Ravenscar Profile. * Terminal styling is now available for the CLI and the TUI. * Removed support for old demangling styles arm, edg, gnu, hp and lucid. * Support for new native configuration RISC-V GNU/Linux (riscv*-*-linux*). - Implemented access to more POWER8 registers. [fate#326120, fate#325178] - Handle most of new s390 arch13 instructions. [fate#327369, jsc#ECO-368] This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2494=1 Package List: - openSUSE Leap 15.1 (x86_64): gdb-8.3.1-lp151.4.3.1 gdb-debuginfo-8.3.1-lp151.4.3.1 gdb-debugsource-8.3.1-lp151.4.3.1 gdb-testresults-8.3.1-lp151.4.3.1 gdbserver-8.3.1-lp151.4.3.1 gdbserver-debuginfo-8.3.1-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-1010180.html https://bugzilla.suse.com/1115034 https://bugzilla.suse.com/1142772 https://bugzilla.suse.com/1145692 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] New Intel CPU issues announced - openSUSE fixes coming
by Marcus Meissner 12 Nov '19

12 Nov '19

Hi folks, Today Intel and security researchers published a number of security issues covering various Intel hardware and software components. These cover half a year of collected fixes, only some of them are relevant to the Operating System vendors. Two main relevant security issues are in there: 1. Machine Check Error on Page Size Changes / CVE-2018-12207 A race condition during instruction decoding and extended pagetable management on Intel CPUs could lead to Machine Check Errors (crashes of a CPU), a denial of service attack. This issue could be used by an attacker with full access to a guest VM to crash the host. This race condition exists in all current Intel CPUs, except Intel Atom and Knights Landing. There is a Intel Whitepaper: https://software.intel.com/security-software-guidance/insights/deep-dive-ma… SUSE provides a software mitigation for this issue in updates to its Hypervisors, both for KVM in the Linux Kernel and for XEN. The mitigations are not needed in guests. The mitigation is enabled by default, our TID https://www.suse.com/support/kb/doc/?id=7023735 has details on how to check its status and configuration. Updated packages are linked from https://www.suse.com/security/cve/CVE-2018-12207/ 2. Transactional Asynchronous Abort (TAA) / CVE-2019-11135 Researchers from TU Graz, KU Leuven, CISPA Helmholtz Center, VUSec group at VU Amsterdam have identified an additional CPU based information leak attack, similar to the "Microarchitectural Data Sampling" (MDS) attack published in May 2019. They showed that during an asynchronous abort of a Transactional Execution, various microarchitectural buffers might be speculatively accessed that could cause side effects similar to the MDS attack, leaking small amounts of recently or currently used data on the same CPU core. Intel has provided Microcode updates, and SUSE provides fixed Kernel and XEN packages to help mitigate this problem. Intels whitepaper is available at https://software.intel.com/security-software-guidance/insights/deep-dive-in… Depending on the environment, administrators also need to consider disabling Hyperthreading and/or disabling TSX support. Disabling TSX is only possible with the help of CPU Microcode updates on Cascade Lake and newer systems. We have not enabled the TSX disablement and the HT disablement, only the buffer clearing, to avoid performance losses. The options to control the mitigations are available and documented in our TID https://www.suse.com/support/kb/doc/?id=7024251 . Updated packages are linked from our https://www.suse.com/security/cve/CVE-2019-11135/ page SUSE has supplied online updates for the Linux Kernel, XEN, Intel CPU Microcode, and qemu to mitigate these issues. We will release openSUSE Leap and Tumbleweed fixes for this in the next day(s). Ciao, Marcus -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2483-1: moderate: Security update for libssh2_org
by opensuse-security＠opensuse.org 11 Nov '19

11 Nov '19

openSUSE Security Update: Security update for libssh2_org ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2483-1 Rating: moderate References: #1154862 Cross-References: CVE-2019-17498 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libssh2_org fixes the following issue: - CVE-2019-17498: Fixed an integer overflow in a bounds check that might have led to the disclosure of sensitive information or a denial of service (bsc#1154862). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2483=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libssh2-1-1.8.0-lp151.6.3.1 libssh2-1-debuginfo-1.8.0-lp151.6.3.1 libssh2-devel-1.8.0-lp151.6.3.1 libssh2_org-debugsource-1.8.0-lp151.6.3.1 - openSUSE Leap 15.1 (x86_64): libssh2-1-32bit-1.8.0-lp151.6.3.1 libssh2-1-32bit-debuginfo-1.8.0-lp151.6.3.1 References: https://www.suse.com/security/cve/CVE-2019-17498.html https://bugzilla.suse.com/1154862 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2477-1: moderate: Recommended update for bcm20702a1-firmware
by opensuse-security＠opensuse.org 10 Nov '19

10 Nov '19

openSUSE Security Update: Recommended update for bcm20702a1-firmware ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2477-1 Rating: moderate References: #1087996 #1154083 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for bcm20702a1-firmware fixes the following issues: Changes in bcm20702a1-firmware: - Use https to fetch the archive to avoid person-in-the-middle attacks (boo#1154083) - Fetch & install another variant firmware (0a5c:21e8) (boo#1087996) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2477=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2477=1 Package List: - openSUSE Leap 15.1 (noarch): bcm20702a1-firmware-1201650-lp151.3.3.1 - openSUSE Leap 15.0 (noarch): bcm20702a1-firmware-1201650-lp150.2.3.1 References: https://bugzilla.suse.com/1087996 https://bugzilla.suse.com/1154083 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2472-1: moderate: Security update for python-ecdsa
by opensuse-security＠opensuse.org 10 Nov '19

10 Nov '19

openSUSE Security Update: Security update for python-ecdsa ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2472-1 Rating: moderate References: #1153165 #1154217 Cross-References: CVE-2019-14853 CVE-2019-14859 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python-ecdsa to version 0.13.3 fixes the following issues: Security issues fixed: - CVE-2019-14853: Fixed unexpected exceptions during signature decoding (bsc#1153165). - CVE-2019-14859: Fixed a signature malleability caused by insufficient checks of DER encoding (bsc#1154217). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2472=1 Package List: - openSUSE Leap 15.0 (noarch): python2-ecdsa-0.13.3-lp150.2.3.1 python3-ecdsa-0.13.3-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-14853.html https://www.suse.com/security/cve/CVE-2019-14859.html https://bugzilla.suse.com/1153165 https://bugzilla.suse.com/1154217 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2474-1: moderate: Security update for python-ecdsa
by opensuse-security＠opensuse.org 10 Nov '19

10 Nov '19

openSUSE Security Update: Security update for python-ecdsa ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2474-1 Rating: moderate References: #1153165 #1154217 Cross-References: CVE-2019-14853 CVE-2019-14859 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python-ecdsa to version 0.13.3 fixes the following issues: Security issues fixed: - CVE-2019-14853: Fixed unexpected exceptions during signature decoding (bsc#1153165). - CVE-2019-14859: Fixed a signature malleability caused by insufficient checks of DER encoding (bsc#1154217). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2474=1 Package List: - openSUSE Leap 15.1 (noarch): python2-ecdsa-0.13.3-lp151.3.3.1 python3-ecdsa-0.13.3-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-14853.html https://www.suse.com/security/cve/CVE-2019-14859.html https://bugzilla.suse.com/1153165 https://bugzilla.suse.com/1154217 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2466-1: moderate: Security update for gdal
by opensuse-security＠opensuse.org 09 Nov '19

09 Nov '19

openSUSE Security Update: Security update for gdal ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2466-1 Rating: moderate References: #1153918 Cross-References: CVE-2019-17545 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gdal to version 2.4.3 fixes the following issues: gdal was updated to 2.4.3: - CVE-2019-17545: Fixed a double free vulnerability in OGRExpatRealloc (boo#1153918). - Multiple bug and stability fixes For more information regarding the release at: https://trac.osgeo.org/gdal/wiki/Release/2.4.3-News Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2466=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2466=1 Package List: - openSUSE Leap 15.1 (x86_64): gdal-2.4.3-lp151.3.3.1 gdal-debuginfo-2.4.3-lp151.3.3.1 gdal-debugsource-2.4.3-lp151.3.3.1 gdal-devel-2.4.3-lp151.3.3.1 libgdal20-2.4.3-lp151.3.3.1 libgdal20-debuginfo-2.4.3-lp151.3.3.1 perl-gdal-2.4.3-lp151.3.3.1 perl-gdal-debuginfo-2.4.3-lp151.3.3.1 python2-GDAL-2.4.3-lp151.3.3.1 python2-GDAL-debuginfo-2.4.3-lp151.3.3.1 python3-GDAL-2.4.3-lp151.3.3.1 python3-GDAL-debuginfo-2.4.3-lp151.3.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le x86_64): gdal-2.4.3-bp151.4.3.1 gdal-devel-2.4.3-bp151.4.3.1 libgdal20-2.4.3-bp151.4.3.1 perl-gdal-2.4.3-bp151.4.3.1 python2-GDAL-2.4.3-bp151.4.3.1 python3-GDAL-2.4.3-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-17545.html https://bugzilla.suse.com/1153918 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2453-1: moderate: Security update for python3
by opensuse-security＠opensuse.org 09 Nov '19

09 Nov '19

openSUSE Security Update: Security update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2453-1 Rating: moderate References: #1149121 #1149792 #1149955 #1151490 #1153238 Cross-References: CVE-2019-16056 CVE-2019-16935 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for python3 to 3.6.9 fixes the following issues: Security issues fixed: - CVE-2019-16056: Fixed a parser issue in the email module. (bsc#1149955) - CVE-2019-16935: Fixed a reflected XSS in python/Lib/DocXMLRPCServer.py (bsc#1153238). Non-security issues fixed: - Fixed regression of OpenSSL 1.1.1b-1 in EVP_PBE_scrypt() with salt=NULL. (bsc#1151490) - Improved locale handling by implementing PEP 538. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2453=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libpython3_6m1_0-3.6.9-lp150.2.14.1 libpython3_6m1_0-debuginfo-3.6.9-lp150.2.14.1 python3-3.6.9-lp150.2.14.1 python3-base-3.6.9-lp150.2.14.1 python3-base-debuginfo-3.6.9-lp150.2.14.1 python3-base-debugsource-3.6.9-lp150.2.14.1 python3-curses-3.6.9-lp150.2.14.1 python3-curses-debuginfo-3.6.9-lp150.2.14.1 python3-dbm-3.6.9-lp150.2.14.1 python3-dbm-debuginfo-3.6.9-lp150.2.14.1 python3-debuginfo-3.6.9-lp150.2.14.1 python3-debugsource-3.6.9-lp150.2.14.1 python3-devel-3.6.9-lp150.2.14.1 python3-devel-debuginfo-3.6.9-lp150.2.14.1 python3-idle-3.6.9-lp150.2.14.1 python3-testsuite-3.6.9-lp150.2.14.1 python3-testsuite-debuginfo-3.6.9-lp150.2.14.1 python3-tk-3.6.9-lp150.2.14.1 python3-tk-debuginfo-3.6.9-lp150.2.14.1 python3-tools-3.6.9-lp150.2.14.1 - openSUSE Leap 15.0 (x86_64): libpython3_6m1_0-32bit-3.6.9-lp150.2.14.1 libpython3_6m1_0-32bit-debuginfo-3.6.9-lp150.2.14.1 python3-32bit-3.6.9-lp150.2.14.1 python3-32bit-debuginfo-3.6.9-lp150.2.14.1 python3-base-32bit-3.6.9-lp150.2.14.1 python3-base-32bit-debuginfo-3.6.9-lp150.2.14.1 References: https://www.suse.com/security/cve/CVE-2019-16056.html https://www.suse.com/security/cve/CVE-2019-16935.html https://bugzilla.suse.com/1149121 https://bugzilla.suse.com/1149792 https://bugzilla.suse.com/1149955 https://bugzilla.suse.com/1151490 https://bugzilla.suse.com/1153238 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2454-1: moderate: Security update for libtomcrypt
by opensuse-security＠opensuse.org 09 Nov '19

09 Nov '19

openSUSE Security Update: Security update for libtomcrypt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2454-1 Rating: moderate References: #1153433 Cross-References: CVE-2019-17362 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libtomcrypt fixes the following issue: CVE-2019-17362: Fixed an improper detection of invalid UTF-8 sequences that could have led to DoS or information disclosure via crafted DER-encoded data (bsc#1153433). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2454=1 Package List: - openSUSE Leap 15.0 (x86_64): libtomcrypt-debugsource-1.17-lp150.2.3.1 libtomcrypt-devel-1.17-lp150.2.3.1 libtomcrypt-examples-1.17-lp150.2.3.1 libtomcrypt0-1.17-lp150.2.3.1 libtomcrypt0-debuginfo-1.17-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-17362.html https://bugzilla.suse.com/1153433 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2464-1: important: Recommended update for MozillaThunderbird
by opensuse-security＠opensuse.org 09 Nov '19

09 Nov '19

openSUSE Security Update: Recommended update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2464-1 Rating: important References: #1149126 #1149429 #1151186 #1152778 #1153879 #1154738 Cross-References: CVE-2019-11757 CVE-2019-11758 CVE-2019-11759 CVE-2019-11760 CVE-2019-11761 CVE-2019-11762 CVE-2019-11763 CVE-2019-11764 CVE-2019-15903 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 68.2.1 provides the following fixes: - Security issues fixed (bsc#1154738): * CVE-2019-15903: Fixed a heap overflow in the expat library (bsc#1149429). * CVE-2019-11757: Fixed a use-after-free when creating index updates in IndexedDB (bsc#1154738). * CVE-2019-11758: Fixed a potentially exploitable crash due to 360 Total Security (bsc#1154738). * CVE-2019-11759: Fixed a stack buffer overflow in HKDF output (bsc#1154738). * CVE-2019-11760: Fixed a stack buffer overflow in WebRTC networking (bsc#1154738). * CVE-2019-11761: Fixed an unintended access to a privileged JSONView object (bsc#1154738). * CVE-2019-11762: Fixed a same-origin-property violation (bsc#1154738). * CVE-2019-11763: Fixed an XSS bypass (bsc#1154738). * CVE-2019-11764: Fixed several memory safety bugs (bsc#1154738). Other fixes (bsc#1153879): * Some attachments couldn't be opened in messages originating from MS Outlook 2016. * Address book import from CSV. * Performance problem in message body search. * Ctrl+Enter to send a message would open an attachment if the attachment pane had focus. * Calendar: Issues with "Today Pane" start-up. * Calendar: Glitches with custom repeat and reminder number input. * Calendar: Problems with WCAP provider. * A language for the user interface can now be chosen in the advanced settings * Fixed an issue with Google authentication (OAuth2) * Fixed an issue where selected or unread messages were not shown in the correct color in the thread pane under some circumstances * Fixed an issue where when using a language pack, names of standard folders were not localized (bsc#1149126) * Fixed an issue where the address book default startup directory in preferences panel not persisted * Fixed various visual glitches * Fixed issues with the chat * Fixed building with rust >= 1.38. * Fixrd LTO build without PGO. * Removed kde.js since disabling instantApply breaks extensions and is now obsolete with the move to HTML views for preferences. (bsc#1151186) * Updated create-tar.sh. (bsc#1152778) * Deactivated the crashreporter for the last remaining arch. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2464=1 Package List: - openSUSE Leap 15.0 (x86_64): MozillaThunderbird-68.2.1-lp150.3.54.1 MozillaThunderbird-debuginfo-68.2.1-lp150.3.54.1 MozillaThunderbird-debugsource-68.2.1-lp150.3.54.1 MozillaThunderbird-translations-common-68.2.1-lp150.3.54.1 MozillaThunderbird-translations-other-68.2.1-lp150.3.54.1 References: https://www.suse.com/security/cve/CVE-2019-11757.html https://www.suse.com/security/cve/CVE-2019-11758.html https://www.suse.com/security/cve/CVE-2019-11759.html https://www.suse.com/security/cve/CVE-2019-11760.html https://www.suse.com/security/cve/CVE-2019-11761.html https://www.suse.com/security/cve/CVE-2019-11762.html https://www.suse.com/security/cve/CVE-2019-11763.html https://www.suse.com/security/cve/CVE-2019-11764.html https://www.suse.com/security/cve/CVE-2019-15903.html https://bugzilla.suse.com/1149126 https://bugzilla.suse.com/1149429 https://bugzilla.suse.com/1151186 https://bugzilla.suse.com/1152778 https://bugzilla.suse.com/1153879 https://bugzilla.suse.com/1154738 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0