December 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:2615-1: moderate: Security update for libarchive
by opensuse-security＠opensuse.org 03 Dec '19

03 Dec '19

openSUSE Security Update: Security update for libarchive ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2615-1 Rating: moderate References: #1120653 #1120654 #1124341 #1124342 #1155079 Cross-References: CVE-2018-1000877 CVE-2018-1000878 CVE-2019-1000019 CVE-2019-1000020 CVE-2019-18408 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for libarchive fixes the following issues: Security issues fixed: - CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653). - CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654). - CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341). - CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342). - CVE-2019-18408: Fixed a use-after-free in RAR format support (bsc#1155079). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2615=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): bsdtar-3.3.2-lp150.10.1 bsdtar-debuginfo-3.3.2-lp150.10.1 libarchive-debugsource-3.3.2-lp150.10.1 libarchive-devel-3.3.2-lp150.10.1 libarchive13-3.3.2-lp150.10.1 libarchive13-debuginfo-3.3.2-lp150.10.1 - openSUSE Leap 15.0 (x86_64): libarchive13-32bit-3.3.2-lp150.10.1 libarchive13-32bit-debuginfo-3.3.2-lp150.10.1 References: https://www.suse.com/security/cve/CVE-2018-1000877.html https://www.suse.com/security/cve/CVE-2018-1000878.html https://www.suse.com/security/cve/CVE-2019-1000019.html https://www.suse.com/security/cve/CVE-2019-1000020.html https://www.suse.com/security/cve/CVE-2019-18408.html https://bugzilla.suse.com/1120653 https://bugzilla.suse.com/1120654 https://bugzilla.suse.com/1124341 https://bugzilla.suse.com/1124342 https://bugzilla.suse.com/1155079 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2620-1: important: Security update for ucode-intel
by opensuse-security＠opensuse.org 03 Dec '19

03 Dec '19

openSUSE Security Update: Security update for ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2620-1 Rating: important References: #1157004 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for ucode-intel fixes the following issues: - Updated to 20191115 official security release (bsc#1157004) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2620=1 Package List: - openSUSE Leap 15.0 (x86_64): ucode-intel-20191115-lp150.2.36.1 References: https://bugzilla.suse.com/1157004 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2612-1: Security update for libxml2
by opensuse-security＠opensuse.org 03 Dec '19

03 Dec '19

openSUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2612-1 Rating: low References: #1123919 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for libxml2 doesn't fix any additional security issues, but correct its rpm changelog to reflect all CVEs that have been fixed over the past. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2612=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libxml2-2-2.9.7-lp151.5.6.1 libxml2-2-debuginfo-2.9.7-lp151.5.6.1 libxml2-debugsource-2.9.7-lp151.5.6.1 libxml2-devel-2.9.7-lp151.5.6.1 libxml2-tools-2.9.7-lp151.5.6.1 libxml2-tools-debuginfo-2.9.7-lp151.5.6.1 python-libxml2-python-debugsource-2.9.7-lp151.5.6.1 python2-libxml2-python-2.9.7-lp151.5.6.1 python2-libxml2-python-debuginfo-2.9.7-lp151.5.6.1 python3-libxml2-python-2.9.7-lp151.5.6.1 python3-libxml2-python-debuginfo-2.9.7-lp151.5.6.1 - openSUSE Leap 15.1 (x86_64): libxml2-2-32bit-2.9.7-lp151.5.6.1 libxml2-2-32bit-debuginfo-2.9.7-lp151.5.6.1 libxml2-devel-32bit-2.9.7-lp151.5.6.1 - openSUSE Leap 15.1 (noarch): libxml2-doc-2.9.7-lp151.5.6.1 References: https://bugzilla.suse.com/1123919 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2611-1: moderate: Security update for libidn2
by opensuse-security＠opensuse.org 03 Dec '19

03 Dec '19

openSUSE Security Update: Security update for libidn2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2611-1 Rating: moderate References: #1154884 #1154887 Cross-References: CVE-2019-12290 CVE-2019-18224 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libidn2 to version 2.2.0 fixes the following issues: - CVE-2019-12290: Fixed an improper round-trip check when converting A-labels to U-labels (bsc#1154884). - CVE-2019-18224: Fixed a heap-based buffer overflow that was caused by long domain strings (bsc#1154887). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2611=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libidn2-0-2.2.0-lp151.3.3.1 libidn2-0-debuginfo-2.2.0-lp151.3.3.1 libidn2-debugsource-2.2.0-lp151.3.3.1 libidn2-devel-2.2.0-lp151.3.3.1 libidn2-tools-2.2.0-lp151.3.3.1 libidn2-tools-debuginfo-2.2.0-lp151.3.3.1 - openSUSE Leap 15.1 (noarch): libidn2-lang-2.2.0-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libidn2-0-32bit-2.2.0-lp151.3.3.1 libidn2-0-32bit-debuginfo-2.2.0-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-12290.html https://www.suse.com/security/cve/CVE-2019-18224.html https://bugzilla.suse.com/1154884 https://bugzilla.suse.com/1154887 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2613-1: moderate: Security update for libidn2
by opensuse-security＠opensuse.org 03 Dec '19

03 Dec '19

openSUSE Security Update: Security update for libidn2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2613-1 Rating: moderate References: #1154884 #1154887 Cross-References: CVE-2019-12290 CVE-2019-18224 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libidn2 to version 2.2.0 fixes the following issues: - CVE-2019-12290: Fixed an improper round-trip check when converting A-labels to U-labels (bsc#1154884). - CVE-2019-18224: Fixed a heap-based buffer overflow that was caused by long domain strings (bsc#1154887). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2613=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libidn2-0-2.2.0-lp150.2.3.1 libidn2-0-debuginfo-2.2.0-lp150.2.3.1 libidn2-debugsource-2.2.0-lp150.2.3.1 libidn2-devel-2.2.0-lp150.2.3.1 libidn2-tools-2.2.0-lp150.2.3.1 libidn2-tools-debuginfo-2.2.0-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libidn2-0-32bit-2.2.0-lp150.2.3.1 libidn2-0-32bit-debuginfo-2.2.0-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): libidn2-lang-2.2.0-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-12290.html https://www.suse.com/security/cve/CVE-2019-18224.html https://bugzilla.suse.com/1154884 https://bugzilla.suse.com/1154887 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE Leap 15.0 has reached end of SUSE support
by Marcus Meissner 03 Dec '19

03 Dec '19

Hi all, With the release of the last updates on Dec 3rd, 2019 the SUSE sponsored maintenance of openSUSE Leap 15.0 has ended. openSUSE Leap 15.0 is now officially discontinued and out of support by SUSE. The currently maintained stable release is openSUSE Leap 15.1, which will be maintained until end of November 2020. See https://en.opensuse.org/Lifetime Upgrading is easy. See the links below for instructions: https://doc.opensuse.org/documentation/leap/startup/html/book.opensuse.star… https://en.opensuse.org/SDB:System_upgrade https://en.opensuse.org/SDB:Offline_upgrade openSUSE Leap 15.0 was released end of May 2018, making it 18 months of security and bugfix support. It was the fourth hybrid distribution which used sources from SUSE Linux Enterprise and from our community developers to bridge a gap between matured packages and newer packages found in openSUSE Tumbleweed. Some statistics on the released patches (compared to Leap 42.3), although 42.3 had 24 months of runtime. (Weighted is new*24/18-old) Agenda: current number (42.3 number / total diff / weighted diff 18/24) Total updates: 1662 (1734 / -72 / +482) Updates imported from SUSE Linux Enterprise: 1119 (994 / +125 / +498) Updates provided by community developers: 543 (740 / -197 / -16) Security: 700 (901 / - 201 / +32) Recommended: 937 (794 / +143 / +455) Optional: 25 (37 / -12 / -4) Feature: 0 (2 / -2 / -2) Fixed CVE-entries: 2218 (3181 / -963 / -224) Fixed Bugs (overall): 5458 (5355 / +103 / +1922) A huge thanks to our awesome packagers, community, and all involved people, who made the next great release possible! Your maintenance- and security-team

1 0

[security-announce] openSUSE-SU-2019:2607-1: moderate: Recommended update for openafs
by opensuse-security＠opensuse.org 02 Dec '19

02 Dec '19

openSUSE Security Update: Recommended update for openafs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2607-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for openafs fixes the following issues: Update to security-release 1.8.5, adresses: * OPENAFS-SA-2019-001: Skip server OUT args on error * OPENAFS-SA-2019-002: Zero all server RPC args * OPENAFS-SA-2019-003: ubik: Avoid unlocked ubik_currentTrans deref update to official version 1.8.4 * support Linux-kernel 5.3 * Avoid non-dir ENOENT errors in afs_lookup * fix parsing of fileservers with -vlruthresh, etc. * other bugfixes update to pre-release 1.8.4pre2 * fix builds for Linux-kernels 5.3 update to 1.8.3 - fix broken directory layout - allow crypt to be set/unset on startup of client update to pre-release 1.8.3pre1 * fix builds for Linux-kernels 4.20 and 5.0 * other fixes, see RELNOTES-1.8.3pre1 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2607=1 Package List: - openSUSE Leap 15.1 (x86_64): openafs-1.8.5-lp151.2.3.1 openafs-authlibs-1.8.5-lp151.2.3.1 openafs-authlibs-debuginfo-1.8.5-lp151.2.3.1 openafs-authlibs-devel-1.8.5-lp151.2.3.1 openafs-client-1.8.5-lp151.2.3.1 openafs-client-debuginfo-1.8.5-lp151.2.3.1 openafs-debuginfo-1.8.5-lp151.2.3.1 openafs-debugsource-1.8.5-lp151.2.3.1 openafs-devel-1.8.5-lp151.2.3.1 openafs-devel-debuginfo-1.8.5-lp151.2.3.1 openafs-fuse_client-1.8.5-lp151.2.3.1 openafs-fuse_client-debuginfo-1.8.5-lp151.2.3.1 openafs-kernel-source-1.8.5-lp151.2.3.1 openafs-kmp-default-1.8.5_k4.12.14_lp151.28.32-lp151.2.3.1 openafs-kmp-default-debuginfo-1.8.5_k4.12.14_lp151.28.32-lp151.2.3.1 openafs-server-1.8.5-lp151.2.3.1 openafs-server-debuginfo-1.8.5-lp151.2.3.1 References: -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2608-1: moderate: Security update for freerdp
by opensuse-security＠opensuse.org 02 Dec '19

02 Dec '19

openSUSE Security Update: Security update for freerdp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2608-1 Rating: moderate References: #1153163 #1153164 Cross-References: CVE-2019-17177 CVE-2019-17178 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for freerdp fixes the following issues: - CVE-2019-17177: Fixed multiple memory leaks in libfreerdp/codec/region.c (bsc#1153163). - CVE-2019-17178: Fixed a memory leak in HuffmanTree_makeFromFrequencies (bsc#1153164). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2608=1 Package List: - openSUSE Leap 15.1 (x86_64): freerdp-2.0.0~rc4-lp151.5.3.1 freerdp-debuginfo-2.0.0~rc4-lp151.5.3.1 freerdp-debugsource-2.0.0~rc4-lp151.5.3.1 freerdp-devel-2.0.0~rc4-lp151.5.3.1 freerdp-server-2.0.0~rc4-lp151.5.3.1 freerdp-server-debuginfo-2.0.0~rc4-lp151.5.3.1 freerdp-wayland-2.0.0~rc4-lp151.5.3.1 freerdp-wayland-debuginfo-2.0.0~rc4-lp151.5.3.1 libfreerdp2-2.0.0~rc4-lp151.5.3.1 libfreerdp2-debuginfo-2.0.0~rc4-lp151.5.3.1 libuwac0-0-2.0.0~rc4-lp151.5.3.1 libuwac0-0-debuginfo-2.0.0~rc4-lp151.5.3.1 libwinpr2-2.0.0~rc4-lp151.5.3.1 libwinpr2-debuginfo-2.0.0~rc4-lp151.5.3.1 uwac0-0-devel-2.0.0~rc4-lp151.5.3.1 winpr2-devel-2.0.0~rc4-lp151.5.3.1 References: https://www.suse.com/security/cve/CVE-2019-17177.html https://www.suse.com/security/cve/CVE-2019-17178.html https://bugzilla.suse.com/1153163 https://bugzilla.suse.com/1153164 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2604-1: moderate: Security update for freerdp
by opensuse-security＠opensuse.org 01 Dec '19

01 Dec '19

openSUSE Security Update: Security update for freerdp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2604-1 Rating: moderate References: #1153163 #1153164 Cross-References: CVE-2019-17177 CVE-2019-17178 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for freerdp fixes the following issues: - CVE-2019-17177: Fixed multiple memory leaks in libfreerdp/codec/region.c (bsc#1153163). - CVE-2019-17178: Fixed a memory leak in HuffmanTree_makeFromFrequencies (bsc#1153164). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2604=1 Package List: - openSUSE Leap 15.0 (x86_64): freerdp-2.0.0~rc4-lp150.10.1 freerdp-debuginfo-2.0.0~rc4-lp150.10.1 freerdp-debugsource-2.0.0~rc4-lp150.10.1 freerdp-devel-2.0.0~rc4-lp150.10.1 freerdp-server-2.0.0~rc4-lp150.10.1 freerdp-server-debuginfo-2.0.0~rc4-lp150.10.1 freerdp-wayland-2.0.0~rc4-lp150.10.1 freerdp-wayland-debuginfo-2.0.0~rc4-lp150.10.1 libfreerdp2-2.0.0~rc4-lp150.10.1 libfreerdp2-debuginfo-2.0.0~rc4-lp150.10.1 libuwac0-0-2.0.0~rc4-lp150.10.1 libuwac0-0-debuginfo-2.0.0~rc4-lp150.10.1 libwinpr2-2.0.0~rc4-lp150.10.1 libwinpr2-debuginfo-2.0.0~rc4-lp150.10.1 uwac0-0-devel-2.0.0~rc4-lp150.10.1 winpr2-devel-2.0.0~rc4-lp150.10.1 References: https://www.suse.com/security/cve/CVE-2019-17177.html https://www.suse.com/security/cve/CVE-2019-17178.html https://bugzilla.suse.com/1153163 https://bugzilla.suse.com/1153164 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2599-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 01 Dec '19

01 Dec '19

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2599-1 Rating: moderate References: #1157614 Cross-References: CVE-2019-18622 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for phpMyAdmin fixes the following issues: phpMyAdmin was updated to 4.9.2: * CVE-2019-18622: SQL injection in Designer feature (boo#1157614) * Fixes for "Failed to set session cookie" error * Advisor with MySQL 8.0.3 and newer * Fix PHP deprecation errors * Fix a situation where exporting users after a delete query could remove users * Fix incorrect "You do not have privileges to manipulate with the users!" warning * Fix copying a database's privileges and several other problems moving columns with MariaDB * Fix for phpMyAdmin not selecting all the values when using shift-click to select during Export Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2599=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2599=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2599=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2599=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-2599=1 Package List: - openSUSE Leap 15.1 (noarch): phpMyAdmin-4.9.2-lp151.2.9.1 - openSUSE Leap 15.0 (noarch): phpMyAdmin-4.9.2-lp150.37.1 - openSUSE Backports SLE-15-SP1 (noarch): phpMyAdmin-4.9.2-bp151.3.9.1 - openSUSE Backports SLE-15 (noarch): phpMyAdmin-4.9.2-bp150.37.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.9.2-37.1 References: https://www.suse.com/security/cve/CVE-2019-18622.html https://bugzilla.suse.com/1157614 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0