December 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:2599-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 01 Dec '19

01 Dec '19

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2599-1 Rating: moderate References: #1157614 Cross-References: CVE-2019-18622 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for phpMyAdmin fixes the following issues: phpMyAdmin was updated to 4.9.2: * CVE-2019-18622: SQL injection in Designer feature (boo#1157614) * Fixes for "Failed to set session cookie" error * Advisor with MySQL 8.0.3 and newer * Fix PHP deprecation errors * Fix a situation where exporting users after a delete query could remove users * Fix incorrect "You do not have privileges to manipulate with the users!" warning * Fix copying a database's privileges and several other problems moving columns with MariaDB * Fix for phpMyAdmin not selecting all the values when using shift-click to select during Export Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2599=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2599=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2599=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2599=1 Package List: - openSUSE Leap 15.1 (noarch): phpMyAdmin-4.9.2-lp151.2.9.1 - openSUSE Leap 15.0 (noarch): phpMyAdmin-4.9.2-lp150.37.1 - openSUSE Backports SLE-15-SP1 (noarch): phpMyAdmin-4.9.2-bp151.3.9.1 - openSUSE Backports SLE-15 (noarch): phpMyAdmin-4.9.2-bp150.37.1 References: https://www.suse.com/security/cve/CVE-2019-18622.html https://bugzilla.suse.com/1157614 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2598-1: important: Security update for strongswan
by opensuse-security＠opensuse.org 01 Dec '19

01 Dec '19

openSUSE Security Update: Security update for strongswan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2598-1 Rating: important References: #1093536 #1094462 #1107874 #1109845 Cross-References: CVE-2018-10811 CVE-2018-16151 CVE-2018-16152 CVE-2018-17540 CVE-2018-5388 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for strongswan fixes the following issues: Security issues fixed: - CVE-2018-5388: Fixed a buffer underflow which may allow to a remote attacker with local user credentials to resource exhaustion and denial of service while reading from the socket (bsc#1094462). - CVE-2018-10811: Fixed a denial of service during the IKEv2 key derivation if the openssl plugin is used in FIPS mode and HMAC-MD5 is negotiated as PRF (bsc#1093536). - CVE-2018-16151,CVE-2018-16152: Fixed multiple flaws in the gmp plugin which might lead to authorization bypass (bsc#1107874). - CVE-2018-17540: Fixed an improper input validation in gmp plugin (bsc#1109845). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2598=1 Package List: - openSUSE Leap 15.1 (noarch): strongswan-doc-5.6.0-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): strongswan-5.6.0-lp151.4.3.1 strongswan-debuginfo-5.6.0-lp151.4.3.1 strongswan-debugsource-5.6.0-lp151.4.3.1 strongswan-hmac-5.6.0-lp151.4.3.1 strongswan-ipsec-5.6.0-lp151.4.3.1 strongswan-ipsec-debuginfo-5.6.0-lp151.4.3.1 strongswan-libs0-5.6.0-lp151.4.3.1 strongswan-libs0-debuginfo-5.6.0-lp151.4.3.1 strongswan-mysql-5.6.0-lp151.4.3.1 strongswan-mysql-debuginfo-5.6.0-lp151.4.3.1 strongswan-nm-5.6.0-lp151.4.3.1 strongswan-nm-debuginfo-5.6.0-lp151.4.3.1 strongswan-sqlite-5.6.0-lp151.4.3.1 strongswan-sqlite-debuginfo-5.6.0-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-10811.html https://www.suse.com/security/cve/CVE-2018-16151.html https://www.suse.com/security/cve/CVE-2018-16152.html https://www.suse.com/security/cve/CVE-2018-17540.html https://www.suse.com/security/cve/CVE-2018-5388.html https://bugzilla.suse.com/1093536 https://bugzilla.suse.com/1094462 https://bugzilla.suse.com/1107874 https://bugzilla.suse.com/1109845 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2597-1: moderate: Security update for clamav
by opensuse-security＠opensuse.org 01 Dec '19

01 Dec '19

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2597-1 Rating: moderate References: #1144504 #1149458 #1151839 Cross-References: CVE-2019-12625 CVE-2019-12900 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for clamav fixes the following issues: Security issue fixed: - CVE-2019-12625: Fixed a ZIP bomb issue by adding detection and heuristics for zips with overlapping files (bsc#1144504). - CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors (bsc#1149458). Non-security issues fixed: - Added the --max-scantime clamscan option and MaxScanTime clamd configuration option (bsc#1144504). - Increased the startup timeout of clamd to 5 minutes to cater for the grown virus database as a workaround until clamd has learned to talk to systemd to extend the timeout as long as needed (bsc#1151839). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2597=1 Package List: - openSUSE Leap 15.0 (x86_64): clamav-0.100.3-lp150.2.13.1 clamav-debuginfo-0.100.3-lp150.2.13.1 clamav-debugsource-0.100.3-lp150.2.13.1 clamav-devel-0.100.3-lp150.2.13.1 libclamav7-0.100.3-lp150.2.13.1 libclamav7-debuginfo-0.100.3-lp150.2.13.1 libclammspack0-0.100.3-lp150.2.13.1 libclammspack0-debuginfo-0.100.3-lp150.2.13.1 References: https://www.suse.com/security/cve/CVE-2019-12625.html https://www.suse.com/security/cve/CVE-2019-12900.html https://bugzilla.suse.com/1144504 https://bugzilla.suse.com/1149458 https://bugzilla.suse.com/1151839 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0