December 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:2628-1: moderate: Security update for calamares
by opensuse-security＠opensuse.org 03 Dec '19

03 Dec '19

openSUSE Security Update: Security update for calamares ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2628-1 Rating: moderate References: #1140256 #1152377 Cross-References: CVE-2019-13178 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for calamares fixes the following issues: - Launch with "pkexec calamares" in openSUSE Tumbleweed, but launch with "xdg-su -c calamares" in openSUSE Leap 15. Update to Calamares 3.2.15: - "displaymanager" module now treats "sysconfig" as a regular entry in the "displaymanagers" list, and the "sysconfigSetup" key is used as a shorthand to force only that entry in the list. - "machineid" module has been re-written in C++ and extended with a new configuration key to generate urandom pool data. - "unpackfs" now supports a special "sourcefs" value of file for copying single files (optionally with renaming) or directory trees to the target system. - "unpackfs" now support an "exclude" and "excludeFile" setting for excluding particular files or patters from unpacking. Update to Calamares 3.2.14: - "locale" module no longer recognizes the legacy GeoIP configuration. This has been deprecated since Calamares 3.2.8 and is now removed. - "packagechooser" module can now be custom-labeled in the overall progress (left-hand column). - "displaymanager" module now recognizes KDE Plasma 5.17. - "displaymanager" module now can handle Wayland sessions and can detect sessions from their .desktop files. - "unpackfs" now has special handling for sourcefs setting “file”. Update to Calamares 3.2.13. More about upstream changes: https://calamares.io/calamares-3.2.13-is-out/ and https://calamares.io/calamares-3.2.12-is-out/ Update to Calamares 3.2.11: - Fix race condition in modules/luksbootkeyfile/main.py (boo#1140256, CVE-2019-13178) - more about upstream changes in 3.2 versions can be found in https://calamares.io/ and https://github.com/calamares/calamares/releases Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2628=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2628=1 Package List: - openSUSE Leap 15.1 (x86_64): calamares-3.2.15-lp151.4.3.3 calamares-debuginfo-3.2.15-lp151.4.3.3 calamares-debugsource-3.2.15-lp151.4.3.3 calamares-webview-3.2.15-lp151.4.3.3 calamares-webview-debuginfo-3.2.15-lp151.4.3.3 - openSUSE Leap 15.1 (noarch): calamares-branding-upstream-3.2.15-lp151.4.3.3 - openSUSE Leap 15.0 (x86_64): calamares-3.2.15-lp150.7.2 calamares-debuginfo-3.2.15-lp150.7.2 calamares-debugsource-3.2.15-lp150.7.2 calamares-webview-3.2.15-lp150.7.2 calamares-webview-debuginfo-3.2.15-lp150.7.2 - openSUSE Leap 15.0 (noarch): calamares-branding-upstream-3.2.15-lp150.7.2 References: https://www.suse.com/security/cve/CVE-2019-13178.html https://bugzilla.suse.com/1140256 https://bugzilla.suse.com/1152377 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2626-1: important: Security update for haproxy
by opensuse-security＠opensuse.org 03 Dec '19

03 Dec '19

openSUSE Security Update: Security update for haproxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2626-1 Rating: important References: #1082318 #1154980 #1157712 #1157714 Cross-References: CVE-2019-18277 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for haproxy to version 2.0.10 fixes the following issues: HAProxy was updated to 2.0.10 Security issues fixed: - CVE-2019-18277: Fixed a potential HTTP smuggling in messages with transfer-encoding header missing the "chunked" (bsc#1154980). - Fixed an improper handling of headers which could have led to injecting LFs in H2-to-H1 transfers creating new attack space (bsc#1157712) - Fixed an issue where HEADER frames in idle streams are not rejected and thus trying to decode them HAPrpxy crashes (bsc#1157714). Other issue addressed: - Macro change in the spec file (bsc#1082318) More information regarding the release at: http://git.haproxy.org/?p=haproxy-2.0.git;a=commit;h=ac198b92d461515551b95d aae20954b3053ce87e This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2626=1 Package List: - openSUSE Leap 15.0 (x86_64): haproxy-2.0.10+git0.ac198b92-lp150.2.16.1 haproxy-debuginfo-2.0.10+git0.ac198b92-lp150.2.16.1 haproxy-debugsource-2.0.10+git0.ac198b92-lp150.2.16.1 References: https://www.suse.com/security/cve/CVE-2019-18277.html https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1154980 https://bugzilla.suse.com/1157712 https://bugzilla.suse.com/1157714 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2632-1: moderate: Security update for libarchive
by opensuse-security＠opensuse.org 03 Dec '19

03 Dec '19

openSUSE Security Update: Security update for libarchive ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2632-1 Rating: moderate References: #1120653 #1120654 #1124341 #1124342 #1155079 Cross-References: CVE-2018-1000877 CVE-2018-1000878 CVE-2019-1000019 CVE-2019-1000020 CVE-2019-18408 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for libarchive fixes the following issues: Security issues fixed: - CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653). - CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654). - CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341). - CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342). - CVE-2019-18408: Fixed a use-after-free in RAR format support (bsc#1155079). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2632=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): bsdtar-3.3.2-lp151.5.3.1 bsdtar-debuginfo-3.3.2-lp151.5.3.1 libarchive-debugsource-3.3.2-lp151.5.3.1 libarchive-devel-3.3.2-lp151.5.3.1 libarchive13-3.3.2-lp151.5.3.1 libarchive13-debuginfo-3.3.2-lp151.5.3.1 - openSUSE Leap 15.1 (x86_64): libarchive13-32bit-3.3.2-lp151.5.3.1 libarchive13-32bit-debuginfo-3.3.2-lp151.5.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000877.html https://www.suse.com/security/cve/CVE-2018-1000878.html https://www.suse.com/security/cve/CVE-2019-1000019.html https://www.suse.com/security/cve/CVE-2019-1000020.html https://www.suse.com/security/cve/CVE-2019-18408.html https://bugzilla.suse.com/1120653 https://bugzilla.suse.com/1120654 https://bugzilla.suse.com/1124341 https://bugzilla.suse.com/1124342 https://bugzilla.suse.com/1155079 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2631-1: important: Security update for ucode-intel
by opensuse-security＠opensuse.org 03 Dec '19

03 Dec '19

openSUSE Security Update: Security update for ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2631-1 Rating: important References: #1157004 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for ucode-intel fixes the following issues: - Updated to 20191115 security release (bsc#1157004) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2631=1 Package List: - openSUSE Leap 15.1 (x86_64): ucode-intel-20191115-lp151.2.15.1 References: https://bugzilla.suse.com/1157004 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2629-1: Security update for libxml2
by opensuse-security＠opensuse.org 03 Dec '19

03 Dec '19

openSUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2629-1 Rating: low References: #1123919 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for libxml2 doesn't fix any additional security issues, but correct its rpm changelog to reflect all CVEs that have been fixed over the past. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2629=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libxml2-2-2.9.7-lp150.2.14.1 libxml2-2-debuginfo-2.9.7-lp150.2.14.1 libxml2-debugsource-2.9.7-lp150.2.14.1 libxml2-devel-2.9.7-lp150.2.14.1 libxml2-tools-2.9.7-lp150.2.14.1 libxml2-tools-debuginfo-2.9.7-lp150.2.14.1 - openSUSE Leap 15.0 (noarch): libxml2-doc-2.9.7-lp150.2.14.1 - openSUSE Leap 15.0 (x86_64): libxml2-2-32bit-2.9.7-lp150.2.14.1 libxml2-2-32bit-debuginfo-2.9.7-lp150.2.14.1 libxml2-devel-32bit-2.9.7-lp150.2.14.1 References: https://bugzilla.suse.com/1123919 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2615-1: moderate: Security update for libarchive
by opensuse-security＠opensuse.org 03 Dec '19

03 Dec '19

openSUSE Security Update: Security update for libarchive ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2615-1 Rating: moderate References: #1120653 #1120654 #1124341 #1124342 #1155079 Cross-References: CVE-2018-1000877 CVE-2018-1000878 CVE-2019-1000019 CVE-2019-1000020 CVE-2019-18408 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for libarchive fixes the following issues: Security issues fixed: - CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653). - CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654). - CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341). - CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342). - CVE-2019-18408: Fixed a use-after-free in RAR format support (bsc#1155079). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2615=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): bsdtar-3.3.2-lp150.10.1 bsdtar-debuginfo-3.3.2-lp150.10.1 libarchive-debugsource-3.3.2-lp150.10.1 libarchive-devel-3.3.2-lp150.10.1 libarchive13-3.3.2-lp150.10.1 libarchive13-debuginfo-3.3.2-lp150.10.1 - openSUSE Leap 15.0 (x86_64): libarchive13-32bit-3.3.2-lp150.10.1 libarchive13-32bit-debuginfo-3.3.2-lp150.10.1 References: https://www.suse.com/security/cve/CVE-2018-1000877.html https://www.suse.com/security/cve/CVE-2018-1000878.html https://www.suse.com/security/cve/CVE-2019-1000019.html https://www.suse.com/security/cve/CVE-2019-1000020.html https://www.suse.com/security/cve/CVE-2019-18408.html https://bugzilla.suse.com/1120653 https://bugzilla.suse.com/1120654 https://bugzilla.suse.com/1124341 https://bugzilla.suse.com/1124342 https://bugzilla.suse.com/1155079 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2620-1: important: Security update for ucode-intel
by opensuse-security＠opensuse.org 03 Dec '19

03 Dec '19

openSUSE Security Update: Security update for ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2620-1 Rating: important References: #1157004 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for ucode-intel fixes the following issues: - Updated to 20191115 official security release (bsc#1157004) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2620=1 Package List: - openSUSE Leap 15.0 (x86_64): ucode-intel-20191115-lp150.2.36.1 References: https://bugzilla.suse.com/1157004 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2612-1: Security update for libxml2
by opensuse-security＠opensuse.org 03 Dec '19

03 Dec '19

openSUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2612-1 Rating: low References: #1123919 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for libxml2 doesn't fix any additional security issues, but correct its rpm changelog to reflect all CVEs that have been fixed over the past. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2612=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libxml2-2-2.9.7-lp151.5.6.1 libxml2-2-debuginfo-2.9.7-lp151.5.6.1 libxml2-debugsource-2.9.7-lp151.5.6.1 libxml2-devel-2.9.7-lp151.5.6.1 libxml2-tools-2.9.7-lp151.5.6.1 libxml2-tools-debuginfo-2.9.7-lp151.5.6.1 python-libxml2-python-debugsource-2.9.7-lp151.5.6.1 python2-libxml2-python-2.9.7-lp151.5.6.1 python2-libxml2-python-debuginfo-2.9.7-lp151.5.6.1 python3-libxml2-python-2.9.7-lp151.5.6.1 python3-libxml2-python-debuginfo-2.9.7-lp151.5.6.1 - openSUSE Leap 15.1 (x86_64): libxml2-2-32bit-2.9.7-lp151.5.6.1 libxml2-2-32bit-debuginfo-2.9.7-lp151.5.6.1 libxml2-devel-32bit-2.9.7-lp151.5.6.1 - openSUSE Leap 15.1 (noarch): libxml2-doc-2.9.7-lp151.5.6.1 References: https://bugzilla.suse.com/1123919 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2611-1: moderate: Security update for libidn2
by opensuse-security＠opensuse.org 03 Dec '19

03 Dec '19

openSUSE Security Update: Security update for libidn2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2611-1 Rating: moderate References: #1154884 #1154887 Cross-References: CVE-2019-12290 CVE-2019-18224 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libidn2 to version 2.2.0 fixes the following issues: - CVE-2019-12290: Fixed an improper round-trip check when converting A-labels to U-labels (bsc#1154884). - CVE-2019-18224: Fixed a heap-based buffer overflow that was caused by long domain strings (bsc#1154887). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2611=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libidn2-0-2.2.0-lp151.3.3.1 libidn2-0-debuginfo-2.2.0-lp151.3.3.1 libidn2-debugsource-2.2.0-lp151.3.3.1 libidn2-devel-2.2.0-lp151.3.3.1 libidn2-tools-2.2.0-lp151.3.3.1 libidn2-tools-debuginfo-2.2.0-lp151.3.3.1 - openSUSE Leap 15.1 (noarch): libidn2-lang-2.2.0-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libidn2-0-32bit-2.2.0-lp151.3.3.1 libidn2-0-32bit-debuginfo-2.2.0-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-12290.html https://www.suse.com/security/cve/CVE-2019-18224.html https://bugzilla.suse.com/1154884 https://bugzilla.suse.com/1154887 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2613-1: moderate: Security update for libidn2
by opensuse-security＠opensuse.org 03 Dec '19

03 Dec '19

openSUSE Security Update: Security update for libidn2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2613-1 Rating: moderate References: #1154884 #1154887 Cross-References: CVE-2019-12290 CVE-2019-18224 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libidn2 to version 2.2.0 fixes the following issues: - CVE-2019-12290: Fixed an improper round-trip check when converting A-labels to U-labels (bsc#1154884). - CVE-2019-18224: Fixed a heap-based buffer overflow that was caused by long domain strings (bsc#1154887). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2613=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libidn2-0-2.2.0-lp150.2.3.1 libidn2-0-debuginfo-2.2.0-lp150.2.3.1 libidn2-debugsource-2.2.0-lp150.2.3.1 libidn2-devel-2.2.0-lp150.2.3.1 libidn2-tools-2.2.0-lp150.2.3.1 libidn2-tools-debuginfo-2.2.0-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libidn2-0-32bit-2.2.0-lp150.2.3.1 libidn2-0-32bit-debuginfo-2.2.0-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): libidn2-lang-2.2.0-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-12290.html https://www.suse.com/security/cve/CVE-2019-18224.html https://bugzilla.suse.com/1154884 https://bugzilla.suse.com/1154887 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE Leap 15.0 has reached end of SUSE support
by Marcus Meissner 03 Dec '19

03 Dec '19

Hi all, With the release of the last updates on Dec 3rd, 2019 the SUSE sponsored maintenance of openSUSE Leap 15.0 has ended. openSUSE Leap 15.0 is now officially discontinued and out of support by SUSE. The currently maintained stable release is openSUSE Leap 15.1, which will be maintained until end of November 2020. See https://en.opensuse.org/Lifetime Upgrading is easy. See the links below for instructions: https://doc.opensuse.org/documentation/leap/startup/html/book.opensuse.star… https://en.opensuse.org/SDB:System_upgrade https://en.opensuse.org/SDB:Offline_upgrade openSUSE Leap 15.0 was released end of May 2018, making it 18 months of security and bugfix support. It was the fourth hybrid distribution which used sources from SUSE Linux Enterprise and from our community developers to bridge a gap between matured packages and newer packages found in openSUSE Tumbleweed. Some statistics on the released patches (compared to Leap 42.3), although 42.3 had 24 months of runtime. (Weighted is new*24/18-old) Agenda: current number (42.3 number / total diff / weighted diff 18/24) Total updates: 1662 (1734 / -72 / +482) Updates imported from SUSE Linux Enterprise: 1119 (994 / +125 / +498) Updates provided by community developers: 543 (740 / -197 / -16) Security: 700 (901 / - 201 / +32) Recommended: 937 (794 / +143 / +455) Optional: 25 (37 / -12 / -4) Feature: 0 (2 / -2 / -2) Fixed CVE-entries: 2218 (3181 / -963 / -224) Fixed Bugs (overall): 5458 (5355 / +103 / +1922) A huge thanks to our awesome packagers, community, and all involved people, who made the next great release possible! Your maintenance- and security-team

1 0

[security-announce] openSUSE-SU-2019:2607-1: moderate: Recommended update for openafs
by opensuse-security＠opensuse.org 02 Dec '19

02 Dec '19

openSUSE Security Update: Recommended update for openafs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2607-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for openafs fixes the following issues: Update to security-release 1.8.5, adresses: * OPENAFS-SA-2019-001: Skip server OUT args on error * OPENAFS-SA-2019-002: Zero all server RPC args * OPENAFS-SA-2019-003: ubik: Avoid unlocked ubik_currentTrans deref update to official version 1.8.4 * support Linux-kernel 5.3 * Avoid non-dir ENOENT errors in afs_lookup * fix parsing of fileservers with -vlruthresh, etc. * other bugfixes update to pre-release 1.8.4pre2 * fix builds for Linux-kernels 5.3 update to 1.8.3 - fix broken directory layout - allow crypt to be set/unset on startup of client update to pre-release 1.8.3pre1 * fix builds for Linux-kernels 4.20 and 5.0 * other fixes, see RELNOTES-1.8.3pre1 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2607=1 Package List: - openSUSE Leap 15.1 (x86_64): openafs-1.8.5-lp151.2.3.1 openafs-authlibs-1.8.5-lp151.2.3.1 openafs-authlibs-debuginfo-1.8.5-lp151.2.3.1 openafs-authlibs-devel-1.8.5-lp151.2.3.1 openafs-client-1.8.5-lp151.2.3.1 openafs-client-debuginfo-1.8.5-lp151.2.3.1 openafs-debuginfo-1.8.5-lp151.2.3.1 openafs-debugsource-1.8.5-lp151.2.3.1 openafs-devel-1.8.5-lp151.2.3.1 openafs-devel-debuginfo-1.8.5-lp151.2.3.1 openafs-fuse_client-1.8.5-lp151.2.3.1 openafs-fuse_client-debuginfo-1.8.5-lp151.2.3.1 openafs-kernel-source-1.8.5-lp151.2.3.1 openafs-kmp-default-1.8.5_k4.12.14_lp151.28.32-lp151.2.3.1 openafs-kmp-default-debuginfo-1.8.5_k4.12.14_lp151.28.32-lp151.2.3.1 openafs-server-1.8.5-lp151.2.3.1 openafs-server-debuginfo-1.8.5-lp151.2.3.1 References: -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2608-1: moderate: Security update for freerdp
by opensuse-security＠opensuse.org 02 Dec '19

02 Dec '19

openSUSE Security Update: Security update for freerdp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2608-1 Rating: moderate References: #1153163 #1153164 Cross-References: CVE-2019-17177 CVE-2019-17178 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for freerdp fixes the following issues: - CVE-2019-17177: Fixed multiple memory leaks in libfreerdp/codec/region.c (bsc#1153163). - CVE-2019-17178: Fixed a memory leak in HuffmanTree_makeFromFrequencies (bsc#1153164). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2608=1 Package List: - openSUSE Leap 15.1 (x86_64): freerdp-2.0.0~rc4-lp151.5.3.1 freerdp-debuginfo-2.0.0~rc4-lp151.5.3.1 freerdp-debugsource-2.0.0~rc4-lp151.5.3.1 freerdp-devel-2.0.0~rc4-lp151.5.3.1 freerdp-server-2.0.0~rc4-lp151.5.3.1 freerdp-server-debuginfo-2.0.0~rc4-lp151.5.3.1 freerdp-wayland-2.0.0~rc4-lp151.5.3.1 freerdp-wayland-debuginfo-2.0.0~rc4-lp151.5.3.1 libfreerdp2-2.0.0~rc4-lp151.5.3.1 libfreerdp2-debuginfo-2.0.0~rc4-lp151.5.3.1 libuwac0-0-2.0.0~rc4-lp151.5.3.1 libuwac0-0-debuginfo-2.0.0~rc4-lp151.5.3.1 libwinpr2-2.0.0~rc4-lp151.5.3.1 libwinpr2-debuginfo-2.0.0~rc4-lp151.5.3.1 uwac0-0-devel-2.0.0~rc4-lp151.5.3.1 winpr2-devel-2.0.0~rc4-lp151.5.3.1 References: https://www.suse.com/security/cve/CVE-2019-17177.html https://www.suse.com/security/cve/CVE-2019-17178.html https://bugzilla.suse.com/1153163 https://bugzilla.suse.com/1153164 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2604-1: moderate: Security update for freerdp
by opensuse-security＠opensuse.org 01 Dec '19

01 Dec '19

openSUSE Security Update: Security update for freerdp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2604-1 Rating: moderate References: #1153163 #1153164 Cross-References: CVE-2019-17177 CVE-2019-17178 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for freerdp fixes the following issues: - CVE-2019-17177: Fixed multiple memory leaks in libfreerdp/codec/region.c (bsc#1153163). - CVE-2019-17178: Fixed a memory leak in HuffmanTree_makeFromFrequencies (bsc#1153164). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2604=1 Package List: - openSUSE Leap 15.0 (x86_64): freerdp-2.0.0~rc4-lp150.10.1 freerdp-debuginfo-2.0.0~rc4-lp150.10.1 freerdp-debugsource-2.0.0~rc4-lp150.10.1 freerdp-devel-2.0.0~rc4-lp150.10.1 freerdp-server-2.0.0~rc4-lp150.10.1 freerdp-server-debuginfo-2.0.0~rc4-lp150.10.1 freerdp-wayland-2.0.0~rc4-lp150.10.1 freerdp-wayland-debuginfo-2.0.0~rc4-lp150.10.1 libfreerdp2-2.0.0~rc4-lp150.10.1 libfreerdp2-debuginfo-2.0.0~rc4-lp150.10.1 libuwac0-0-2.0.0~rc4-lp150.10.1 libuwac0-0-debuginfo-2.0.0~rc4-lp150.10.1 libwinpr2-2.0.0~rc4-lp150.10.1 libwinpr2-debuginfo-2.0.0~rc4-lp150.10.1 uwac0-0-devel-2.0.0~rc4-lp150.10.1 winpr2-devel-2.0.0~rc4-lp150.10.1 References: https://www.suse.com/security/cve/CVE-2019-17177.html https://www.suse.com/security/cve/CVE-2019-17178.html https://bugzilla.suse.com/1153163 https://bugzilla.suse.com/1153164 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2599-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 01 Dec '19

01 Dec '19

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2599-1 Rating: moderate References: #1157614 Cross-References: CVE-2019-18622 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for phpMyAdmin fixes the following issues: phpMyAdmin was updated to 4.9.2: * CVE-2019-18622: SQL injection in Designer feature (boo#1157614) * Fixes for "Failed to set session cookie" error * Advisor with MySQL 8.0.3 and newer * Fix PHP deprecation errors * Fix a situation where exporting users after a delete query could remove users * Fix incorrect "You do not have privileges to manipulate with the users!" warning * Fix copying a database's privileges and several other problems moving columns with MariaDB * Fix for phpMyAdmin not selecting all the values when using shift-click to select during Export Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2599=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2599=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2599=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2599=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-2599=1 Package List: - openSUSE Leap 15.1 (noarch): phpMyAdmin-4.9.2-lp151.2.9.1 - openSUSE Leap 15.0 (noarch): phpMyAdmin-4.9.2-lp150.37.1 - openSUSE Backports SLE-15-SP1 (noarch): phpMyAdmin-4.9.2-bp151.3.9.1 - openSUSE Backports SLE-15 (noarch): phpMyAdmin-4.9.2-bp150.37.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.9.2-37.1 References: https://www.suse.com/security/cve/CVE-2019-18622.html https://bugzilla.suse.com/1157614 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2599-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 01 Dec '19

01 Dec '19

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2599-1 Rating: moderate References: #1157614 Cross-References: CVE-2019-18622 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for phpMyAdmin fixes the following issues: phpMyAdmin was updated to 4.9.2: * CVE-2019-18622: SQL injection in Designer feature (boo#1157614) * Fixes for "Failed to set session cookie" error * Advisor with MySQL 8.0.3 and newer * Fix PHP deprecation errors * Fix a situation where exporting users after a delete query could remove users * Fix incorrect "You do not have privileges to manipulate with the users!" warning * Fix copying a database's privileges and several other problems moving columns with MariaDB * Fix for phpMyAdmin not selecting all the values when using shift-click to select during Export Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2599=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2599=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2599=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2599=1 Package List: - openSUSE Leap 15.1 (noarch): phpMyAdmin-4.9.2-lp151.2.9.1 - openSUSE Leap 15.0 (noarch): phpMyAdmin-4.9.2-lp150.37.1 - openSUSE Backports SLE-15-SP1 (noarch): phpMyAdmin-4.9.2-bp151.3.9.1 - openSUSE Backports SLE-15 (noarch): phpMyAdmin-4.9.2-bp150.37.1 References: https://www.suse.com/security/cve/CVE-2019-18622.html https://bugzilla.suse.com/1157614 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2598-1: important: Security update for strongswan
by opensuse-security＠opensuse.org 01 Dec '19

01 Dec '19

openSUSE Security Update: Security update for strongswan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2598-1 Rating: important References: #1093536 #1094462 #1107874 #1109845 Cross-References: CVE-2018-10811 CVE-2018-16151 CVE-2018-16152 CVE-2018-17540 CVE-2018-5388 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for strongswan fixes the following issues: Security issues fixed: - CVE-2018-5388: Fixed a buffer underflow which may allow to a remote attacker with local user credentials to resource exhaustion and denial of service while reading from the socket (bsc#1094462). - CVE-2018-10811: Fixed a denial of service during the IKEv2 key derivation if the openssl plugin is used in FIPS mode and HMAC-MD5 is negotiated as PRF (bsc#1093536). - CVE-2018-16151,CVE-2018-16152: Fixed multiple flaws in the gmp plugin which might lead to authorization bypass (bsc#1107874). - CVE-2018-17540: Fixed an improper input validation in gmp plugin (bsc#1109845). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2598=1 Package List: - openSUSE Leap 15.1 (noarch): strongswan-doc-5.6.0-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): strongswan-5.6.0-lp151.4.3.1 strongswan-debuginfo-5.6.0-lp151.4.3.1 strongswan-debugsource-5.6.0-lp151.4.3.1 strongswan-hmac-5.6.0-lp151.4.3.1 strongswan-ipsec-5.6.0-lp151.4.3.1 strongswan-ipsec-debuginfo-5.6.0-lp151.4.3.1 strongswan-libs0-5.6.0-lp151.4.3.1 strongswan-libs0-debuginfo-5.6.0-lp151.4.3.1 strongswan-mysql-5.6.0-lp151.4.3.1 strongswan-mysql-debuginfo-5.6.0-lp151.4.3.1 strongswan-nm-5.6.0-lp151.4.3.1 strongswan-nm-debuginfo-5.6.0-lp151.4.3.1 strongswan-sqlite-5.6.0-lp151.4.3.1 strongswan-sqlite-debuginfo-5.6.0-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-10811.html https://www.suse.com/security/cve/CVE-2018-16151.html https://www.suse.com/security/cve/CVE-2018-16152.html https://www.suse.com/security/cve/CVE-2018-17540.html https://www.suse.com/security/cve/CVE-2018-5388.html https://bugzilla.suse.com/1093536 https://bugzilla.suse.com/1094462 https://bugzilla.suse.com/1107874 https://bugzilla.suse.com/1109845 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2597-1: moderate: Security update for clamav
by opensuse-security＠opensuse.org 01 Dec '19

01 Dec '19

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2597-1 Rating: moderate References: #1144504 #1149458 #1151839 Cross-References: CVE-2019-12625 CVE-2019-12900 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for clamav fixes the following issues: Security issue fixed: - CVE-2019-12625: Fixed a ZIP bomb issue by adding detection and heuristics for zips with overlapping files (bsc#1144504). - CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors (bsc#1149458). Non-security issues fixed: - Added the --max-scantime clamscan option and MaxScanTime clamd configuration option (bsc#1144504). - Increased the startup timeout of clamd to 5 minutes to cater for the grown virus database as a workaround until clamd has learned to talk to systemd to extend the timeout as long as needed (bsc#1151839). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2597=1 Package List: - openSUSE Leap 15.0 (x86_64): clamav-0.100.3-lp150.2.13.1 clamav-debuginfo-0.100.3-lp150.2.13.1 clamav-debugsource-0.100.3-lp150.2.13.1 clamav-devel-0.100.3-lp150.2.13.1 libclamav7-0.100.3-lp150.2.13.1 libclamav7-debuginfo-0.100.3-lp150.2.13.1 libclammspack0-0.100.3-lp150.2.13.1 libclammspack0-debuginfo-0.100.3-lp150.2.13.1 References: https://www.suse.com/security/cve/CVE-2019-12625.html https://www.suse.com/security/cve/CVE-2019-12900.html https://bugzilla.suse.com/1144504 https://bugzilla.suse.com/1149458 https://bugzilla.suse.com/1151839 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0