February 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:0268-1: important: Security update for systemd
by opensuse-security＠opensuse.org 28 Feb '19

28 Feb '19

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0268-1 Rating: important References: #1111498 #1117025 #1117382 #1120658 #1122000 #1122344 #1123333 #1123892 #1125352 Cross-References: CVE-2019-6454 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has 8 fixes is now available. Description: This update for systemd fixes the following issues: Security vulnerability fixed: - CVE-2019-6454: Fixed a crash of PID1 by sending specially crafted D-BUS message on the system bus by an unprivileged user (bsc#1125352) Other bug fixes and changes: - journal-remote: set a limit on the number of fields in a message - journal-remote: verify entry length from header - journald: set a limit on the number of fields (1k) - journald: do not store the iovec entry for process commandline on stack - core: include Found state in device dumps - device: fix serialization and deserialization of DeviceFound - fix path in btrfs rule (#6844) - assemble multidevice btrfs volumes without external tools (#6607) (bsc#1117025) - Update systemd-system.conf.xml (bsc#1122000) - units: inform user that the default target is started after exiting from rescue or emergency mode - manager: don't skip sigchld handler for main and control pid for services (#3738) - core: Add helper functions unit_{main, control}_pid - manager: Fixing a debug printf formatting mistake (#3640) - manager: Only invoke a single sigchld per unit within a cleanup cycle (bsc#1117382) - core: update invoke_sigchld_event() to handle NULL ->sigchld_event() - sd-event: expose the event loop iteration counter via sd_event_get_iteration() (#3631) - unit: rework a bit how we keep the service fdstore from being destroyed during service restart (bsc#1122344) - core: when restarting services, don't close fds - cryptsetup: Add dependency on loopback setup to generated units - journal-gateway: use localStorage["cursor"] only when it has valid value - journal-gateway: explicitly declare local variables - analyze: actually select longest activated-time of services - sd-bus: fix implicit downcast of bitfield reported by LGTM - core: free lines after reading them (bsc#1123892) - pam_systemd: reword message about not creating a session (bsc#1111498) - pam_systemd: suppress LOG_DEBUG log messages if debugging is off (bsc#1111498) - main: improve RLIMIT_NOFILE handling (#5795) (bsc#1120658) - sd-bus: if we receive an invalid dbus message, ignore and proceeed - automount: don't pass non-blocking pipe to kernel. - units: make sure initrd-cleanup.service terminates before switching to rootfs (bsc#1123333) - units: add Wants=initrd-cleanup.service to initrd-switch-root.target (#4345) (bsc#1123333) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-268=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libsystemd0-228-68.1 libsystemd0-debuginfo-228-68.1 libsystemd0-mini-228-68.1 libsystemd0-mini-debuginfo-228-68.1 libudev-devel-228-68.1 libudev-mini-devel-228-68.1 libudev-mini1-228-68.1 libudev-mini1-debuginfo-228-68.1 libudev1-228-68.1 libudev1-debuginfo-228-68.1 nss-myhostname-228-68.1 nss-myhostname-debuginfo-228-68.1 nss-mymachines-228-68.1 nss-mymachines-debuginfo-228-68.1 systemd-228-68.1 systemd-debuginfo-228-68.1 systemd-debugsource-228-68.1 systemd-devel-228-68.1 systemd-logger-228-68.1 systemd-mini-228-68.1 systemd-mini-debuginfo-228-68.1 systemd-mini-debugsource-228-68.1 systemd-mini-devel-228-68.1 systemd-mini-sysvinit-228-68.1 systemd-sysvinit-228-68.1 udev-228-68.1 udev-debuginfo-228-68.1 udev-mini-228-68.1 udev-mini-debuginfo-228-68.1 - openSUSE Leap 42.3 (x86_64): libsystemd0-32bit-228-68.1 libsystemd0-debuginfo-32bit-228-68.1 libudev1-32bit-228-68.1 libudev1-debuginfo-32bit-228-68.1 nss-myhostname-32bit-228-68.1 nss-myhostname-debuginfo-32bit-228-68.1 systemd-32bit-228-68.1 systemd-debuginfo-32bit-228-68.1 - openSUSE Leap 42.3 (noarch): systemd-bash-completion-228-68.1 systemd-mini-bash-completion-228-68.1 References: https://www.suse.com/security/cve/CVE-2019-6454.html https://bugzilla.suse.com/1111498 https://bugzilla.suse.com/1117025 https://bugzilla.suse.com/1117382 https://bugzilla.suse.com/1120658 https://bugzilla.suse.com/1122000 https://bugzilla.suse.com/1122344 https://bugzilla.suse.com/1123333 https://bugzilla.suse.com/1123892 https://bugzilla.suse.com/1125352 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0265-1: moderate: Security update for libqt5-qtbase
by opensuse-security＠opensuse.org 27 Feb '19

27 Feb '19

openSUSE Security Update: Security update for libqt5-qtbase ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0265-1 Rating: moderate References: #1096328 #1099874 #1108889 #1118595 #1118596 #1120639 Cross-References: CVE-2018-15518 CVE-2018-19873 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has four fixes is now available. Description: This update for libqt5-qtbase provides the following fixes: Security issues fixed: - CVE-2018-15518: Fixed double free in QXmlStreamReader (bsc#1118595) - CVE-2018-19873: Fixed Denial of Service on malformed BMP file in QBmpHandler (bsc#1118596) Non-security issues fixed: - Fix dynamic loading of libGL. (bsc#1099874) - Make sure printer settings are properly remembered. (bsc#1096328) - Add patch to fix fails to load pixmap cursors on XRender less system (bsc#1108889) - Fix krita pop-up palette not working properly (bsc#1120639) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-265=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libQt5Bootstrap-devel-static-5.9.4-lp150.5.4.1 libQt5Concurrent-devel-5.9.4-lp150.5.4.1 libQt5Concurrent5-5.9.4-lp150.5.4.1 libQt5Concurrent5-debuginfo-5.9.4-lp150.5.4.1 libQt5Core-devel-5.9.4-lp150.5.4.1 libQt5Core5-5.9.4-lp150.5.4.1 libQt5Core5-debuginfo-5.9.4-lp150.5.4.1 libQt5DBus-devel-5.9.4-lp150.5.4.1 libQt5DBus-devel-debuginfo-5.9.4-lp150.5.4.1 libQt5DBus5-5.9.4-lp150.5.4.1 libQt5DBus5-debuginfo-5.9.4-lp150.5.4.1 libQt5Gui-devel-5.9.4-lp150.5.4.1 libQt5Gui5-5.9.4-lp150.5.4.1 libQt5Gui5-debuginfo-5.9.4-lp150.5.4.1 libQt5KmsSupport-devel-static-5.9.4-lp150.5.4.1 libQt5Network-devel-5.9.4-lp150.5.4.1 libQt5Network5-5.9.4-lp150.5.4.1 libQt5Network5-debuginfo-5.9.4-lp150.5.4.1 libQt5OpenGL-devel-5.9.4-lp150.5.4.1 libQt5OpenGL5-5.9.4-lp150.5.4.1 libQt5OpenGL5-debuginfo-5.9.4-lp150.5.4.1 libQt5OpenGLExtensions-devel-static-5.9.4-lp150.5.4.1 libQt5PlatformHeaders-devel-5.9.4-lp150.5.4.1 libQt5PlatformSupport-devel-static-5.9.4-lp150.5.4.1 libQt5PrintSupport-devel-5.9.4-lp150.5.4.1 libQt5PrintSupport5-5.9.4-lp150.5.4.1 libQt5PrintSupport5-debuginfo-5.9.4-lp150.5.4.1 libQt5Sql-devel-5.9.4-lp150.5.4.1 libQt5Sql5-5.9.4-lp150.5.4.1 libQt5Sql5-debuginfo-5.9.4-lp150.5.4.1 libQt5Sql5-mysql-5.9.4-lp150.5.4.1 libQt5Sql5-mysql-debuginfo-5.9.4-lp150.5.4.1 libQt5Sql5-postgresql-5.9.4-lp150.5.4.1 libQt5Sql5-postgresql-debuginfo-5.9.4-lp150.5.4.1 libQt5Sql5-sqlite-5.9.4-lp150.5.4.1 libQt5Sql5-sqlite-debuginfo-5.9.4-lp150.5.4.1 libQt5Sql5-unixODBC-5.9.4-lp150.5.4.1 libQt5Sql5-unixODBC-debuginfo-5.9.4-lp150.5.4.1 libQt5Test-devel-5.9.4-lp150.5.4.1 libQt5Test5-5.9.4-lp150.5.4.1 libQt5Test5-debuginfo-5.9.4-lp150.5.4.1 libQt5Widgets-devel-5.9.4-lp150.5.4.1 libQt5Widgets5-5.9.4-lp150.5.4.1 libQt5Widgets5-debuginfo-5.9.4-lp150.5.4.1 libQt5Xml-devel-5.9.4-lp150.5.4.1 libQt5Xml5-5.9.4-lp150.5.4.1 libQt5Xml5-debuginfo-5.9.4-lp150.5.4.1 libqt5-qtbase-common-devel-5.9.4-lp150.5.4.1 libqt5-qtbase-common-devel-debuginfo-5.9.4-lp150.5.4.1 libqt5-qtbase-debugsource-5.9.4-lp150.5.4.1 libqt5-qtbase-devel-5.9.4-lp150.5.4.1 libqt5-qtbase-examples-5.9.4-lp150.5.4.1 libqt5-qtbase-examples-debuginfo-5.9.4-lp150.5.4.1 libqt5-qtbase-platformtheme-gtk3-5.9.4-lp150.5.4.1 libqt5-qtbase-platformtheme-gtk3-debuginfo-5.9.4-lp150.5.4.1 - openSUSE Leap 15.0 (x86_64): libQt5Bootstrap-devel-static-32bit-5.9.4-lp150.5.4.1 libQt5Concurrent-devel-32bit-5.9.4-lp150.5.4.1 libQt5Concurrent5-32bit-5.9.4-lp150.5.4.1 libQt5Concurrent5-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Core-devel-32bit-5.9.4-lp150.5.4.1 libQt5Core5-32bit-5.9.4-lp150.5.4.1 libQt5Core5-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5DBus-devel-32bit-5.9.4-lp150.5.4.1 libQt5DBus-devel-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5DBus5-32bit-5.9.4-lp150.5.4.1 libQt5DBus5-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Gui-devel-32bit-5.9.4-lp150.5.4.1 libQt5Gui5-32bit-5.9.4-lp150.5.4.1 libQt5Gui5-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Network-devel-32bit-5.9.4-lp150.5.4.1 libQt5Network5-32bit-5.9.4-lp150.5.4.1 libQt5Network5-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5OpenGL-devel-32bit-5.9.4-lp150.5.4.1 libQt5OpenGL5-32bit-5.9.4-lp150.5.4.1 libQt5OpenGL5-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5OpenGLExtensions-devel-static-32bit-5.9.4-lp150.5.4.1 libQt5PlatformSupport-devel-static-32bit-5.9.4-lp150.5.4.1 libQt5PrintSupport-devel-32bit-5.9.4-lp150.5.4.1 libQt5PrintSupport5-32bit-5.9.4-lp150.5.4.1 libQt5PrintSupport5-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Sql-devel-32bit-5.9.4-lp150.5.4.1 libQt5Sql5-32bit-5.9.4-lp150.5.4.1 libQt5Sql5-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Sql5-mysql-32bit-5.9.4-lp150.5.4.1 libQt5Sql5-mysql-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Sql5-postgresql-32bit-5.9.4-lp150.5.4.1 libQt5Sql5-postgresql-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Sql5-sqlite-32bit-5.9.4-lp150.5.4.1 libQt5Sql5-sqlite-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Sql5-unixODBC-32bit-5.9.4-lp150.5.4.1 libQt5Sql5-unixODBC-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Test-devel-32bit-5.9.4-lp150.5.4.1 libQt5Test5-32bit-5.9.4-lp150.5.4.1 libQt5Test5-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Widgets-devel-32bit-5.9.4-lp150.5.4.1 libQt5Widgets5-32bit-5.9.4-lp150.5.4.1 libQt5Widgets5-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Xml-devel-32bit-5.9.4-lp150.5.4.1 libQt5Xml5-32bit-5.9.4-lp150.5.4.1 libQt5Xml5-32bit-debuginfo-5.9.4-lp150.5.4.1 libqt5-qtbase-examples-32bit-5.9.4-lp150.5.4.1 libqt5-qtbase-examples-32bit-debuginfo-5.9.4-lp150.5.4.1 - openSUSE Leap 15.0 (noarch): libQt5Core-private-headers-devel-5.9.4-lp150.5.4.1 libQt5DBus-private-headers-devel-5.9.4-lp150.5.4.1 libQt5Gui-private-headers-devel-5.9.4-lp150.5.4.1 libQt5KmsSupport-private-headers-devel-5.9.4-lp150.5.4.1 libQt5Network-private-headers-devel-5.9.4-lp150.5.4.1 libQt5OpenGL-private-headers-devel-5.9.4-lp150.5.4.1 libQt5PlatformSupport-private-headers-devel-5.9.4-lp150.5.4.1 libQt5PrintSupport-private-headers-devel-5.9.4-lp150.5.4.1 libQt5Sql-private-headers-devel-5.9.4-lp150.5.4.1 libQt5Test-private-headers-devel-5.9.4-lp150.5.4.1 libQt5Widgets-private-headers-devel-5.9.4-lp150.5.4.1 libqt5-qtbase-private-headers-devel-5.9.4-lp150.5.4.1 References: https://www.suse.com/security/cve/CVE-2018-15518.html https://www.suse.com/security/cve/CVE-2018-19873.html https://bugzilla.suse.com/1096328 https://bugzilla.suse.com/1099874 https://bugzilla.suse.com/1108889 https://bugzilla.suse.com/1118595 https://bugzilla.suse.com/1118596 https://bugzilla.suse.com/1120639 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0254-1: important: Security update for qemu
by opensuse-security＠opensuse.org 27 Feb '19

27 Feb '19

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0254-1 Rating: important References: #1063993 #1079730 #1100408 #1101982 #1112646 #1114957 #1116717 #1117275 #1119493 #1121600 #1123156 #1123179 Cross-References: CVE-2018-16872 CVE-2018-18954 CVE-2018-19364 CVE-2018-19489 CVE-2019-6778 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has 7 fixes is now available. Description: This update for qemu fixes the following issues: Security issues fixed: - CVE-2019-6778: Fixed a heap buffer overflow issue in the SLiRP networking implementation (bsc#1123156). - CVE-2018-16872: Fixed a host security vulnerability related to handling symlinks in usb-mtp (bsc#1119493). - CVE-2018-19489: Fixed a denial of service vulnerability in virtfs (bsc#1117275). - CVE-2018-19364: Fixed a use-after-free if the virtfs interface resulting in a denial of service (bsc#1116717). - CVE-2018-18954: Fixed a denial of service vulnerability related to PowerPC PowerNV memory operations (bsc#1114957). Non-security issues fixed: - Improved disk performance for qemu on xen (bsc#1100408). - Fixed xen offline migration (bsc#1079730, bsc#1101982, bsc#1063993). - Fixed pwrite64/pread64/write to return 0 over -1 for a zero length NULL buffer in qemu (bsc#1121600). - Use /bin/bash to echo value into sys fs for ksm control (bsc#1112646). - Return specification exception for unimplemented diag 308 subcodes rather than a hardware error (bsc#1123179). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-254=1 Package List: - openSUSE Leap 15.0 (noarch): qemu-ipxe-1.0.0+-lp150.7.18.1 qemu-seabios-1.11.0-lp150.7.18.1 qemu-sgabios-8-lp150.7.18.1 qemu-vgabios-1.11.0-lp150.7.18.1 - openSUSE Leap 15.0 (x86_64): qemu-2.11.2-lp150.7.18.1 qemu-arm-2.11.2-lp150.7.18.1 qemu-arm-debuginfo-2.11.2-lp150.7.18.1 qemu-block-curl-2.11.2-lp150.7.18.1 qemu-block-curl-debuginfo-2.11.2-lp150.7.18.1 qemu-block-dmg-2.11.2-lp150.7.18.1 qemu-block-dmg-debuginfo-2.11.2-lp150.7.18.1 qemu-block-gluster-2.11.2-lp150.7.18.1 qemu-block-gluster-debuginfo-2.11.2-lp150.7.18.1 qemu-block-iscsi-2.11.2-lp150.7.18.1 qemu-block-iscsi-debuginfo-2.11.2-lp150.7.18.1 qemu-block-rbd-2.11.2-lp150.7.18.1 qemu-block-rbd-debuginfo-2.11.2-lp150.7.18.1 qemu-block-ssh-2.11.2-lp150.7.18.1 qemu-block-ssh-debuginfo-2.11.2-lp150.7.18.1 qemu-debuginfo-2.11.2-lp150.7.18.1 qemu-debugsource-2.11.2-lp150.7.18.1 qemu-extra-2.11.2-lp150.7.18.1 qemu-extra-debuginfo-2.11.2-lp150.7.18.1 qemu-guest-agent-2.11.2-lp150.7.18.1 qemu-guest-agent-debuginfo-2.11.2-lp150.7.18.1 qemu-ksm-2.11.2-lp150.7.18.1 qemu-kvm-2.11.2-lp150.7.18.1 qemu-lang-2.11.2-lp150.7.18.1 qemu-linux-user-2.11.2-lp150.7.18.1 qemu-linux-user-debuginfo-2.11.2-lp150.7.18.1 qemu-linux-user-debugsource-2.11.2-lp150.7.18.1 qemu-ppc-2.11.2-lp150.7.18.1 qemu-ppc-debuginfo-2.11.2-lp150.7.18.1 qemu-s390-2.11.2-lp150.7.18.1 qemu-s390-debuginfo-2.11.2-lp150.7.18.1 qemu-testsuite-2.11.2-lp150.7.18.1 qemu-tools-2.11.2-lp150.7.18.1 qemu-tools-debuginfo-2.11.2-lp150.7.18.1 qemu-x86-2.11.2-lp150.7.18.1 qemu-x86-debuginfo-2.11.2-lp150.7.18.1 References: https://www.suse.com/security/cve/CVE-2018-16872.html https://www.suse.com/security/cve/CVE-2018-18954.html https://www.suse.com/security/cve/CVE-2018-19364.html https://www.suse.com/security/cve/CVE-2018-19489.html https://www.suse.com/security/cve/CVE-2019-6778.html https://bugzilla.suse.com/1063993 https://bugzilla.suse.com/1079730 https://bugzilla.suse.com/1100408 https://bugzilla.suse.com/1101982 https://bugzilla.suse.com/1112646 https://bugzilla.suse.com/1114957 https://bugzilla.suse.com/1116717 https://bugzilla.suse.com/1117275 https://bugzilla.suse.com/1119493 https://bugzilla.suse.com/1121600 https://bugzilla.suse.com/1123156 https://bugzilla.suse.com/1123179 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0261-1: important: Security update for gvfs
by opensuse-security＠opensuse.org 27 Feb '19

27 Feb '19

openSUSE Security Update: Security update for gvfs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0261-1 Rating: important References: #1125084 Cross-References: CVE-2019-3827 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gvfs fixes the following issues: Security vulnerability fixed: - CVE-2019-3827: Fixed an issue whereby an unprivileged user was not prompted to give a password when acessing root owned files. (bsc#1125084) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-261=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): gvfs-1.34.2.1-lp150.3.6.1 gvfs-backend-afc-1.34.2.1-lp150.3.6.1 gvfs-backend-afc-debuginfo-1.34.2.1-lp150.3.6.1 gvfs-backend-samba-1.34.2.1-lp150.3.6.1 gvfs-backend-samba-debuginfo-1.34.2.1-lp150.3.6.1 gvfs-backends-1.34.2.1-lp150.3.6.1 gvfs-backends-debuginfo-1.34.2.1-lp150.3.6.1 gvfs-debuginfo-1.34.2.1-lp150.3.6.1 gvfs-debugsource-1.34.2.1-lp150.3.6.1 gvfs-devel-1.34.2.1-lp150.3.6.1 gvfs-fuse-1.34.2.1-lp150.3.6.1 gvfs-fuse-debuginfo-1.34.2.1-lp150.3.6.1 - openSUSE Leap 15.0 (noarch): gvfs-lang-1.34.2.1-lp150.3.6.1 - openSUSE Leap 15.0 (x86_64): gvfs-32bit-1.34.2.1-lp150.3.6.1 gvfs-32bit-debuginfo-1.34.2.1-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-3827.html https://bugzilla.suse.com/1125084 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0252-1: important: Security update for docker-runc
by opensuse-security＠opensuse.org 27 Feb '19

27 Feb '19

openSUSE Security Update: Security update for docker-runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0252-1 Rating: important References: #1121967 Cross-References: CVE-2019-5736 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for docker-runc fixes the following issues: Security issue fixed: - CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-252=1 Package List: - openSUSE Leap 15.0 (noarch): docker-runc-test-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.7.1 - openSUSE Leap 15.0 (x86_64): docker-runc-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.7.1 docker-runc-debuginfo-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.7.1 References: https://www.suse.com/security/cve/CVE-2019-5736.html https://bugzilla.suse.com/1121967 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0255-1: important: Security update for systemd
by opensuse-security＠opensuse.org 27 Feb '19

27 Feb '19

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0255-1 Rating: important References: #1117025 #1121563 #1122000 #1123333 #1123727 #1123892 #1124153 #1125352 Cross-References: CVE-2019-6454 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has 7 fixes is now available. Description: This update for systemd fixes the following issues: - CVE-2019-6454: Overlong DBUS messages could be used to crash systemd (bsc#1125352) - units: make sure initrd-cleanup.service terminates before switching to rootfs (bsc#1123333) - logind: fix bad error propagation - login: log session state "closing" (as well as New/Removed) - logind: fix borked r check - login: don't remove all devices from PID1 when only one was removed - login: we only allow opening character devices - login: correct comment in session_device_free() - login: remember that fds received from PID1 need to be removed eventually - login: fix FDNAME in call to sd_pid_notify_with_fds() - logind: fd 0 is a valid fd - logind: rework sd_eviocrevoke() - logind: check file is device node before using .st_rdev - logind: use the new FDSTOREREMOVE=1 sd_notify() message (bsc#1124153) - core: add a new sd_notify() message for removing fds from the FD store again - logind: make sure we don't trip up on half-initialized session devices (bsc#1123727) - fd-util: accept that kcmp might fail with EPERM/EACCES - core: Fix use after free case in load_from_path() (bsc#1121563) - core: include Found state in device dumps - device: fix serialization and deserialization of DeviceFound - fix path in btrfs rule (#6844) - assemble multidevice btrfs volumes without external tools (#6607) (bsc#1117025) - Update systemd-system.conf.xml (bsc#1122000) - units: inform user that the default target is started after exiting from rescue or emergency mode - core: free lines after reading them (bsc#1123892) - sd-bus: if we receive an invalid dbus message, ignore and proceeed - automount: don't pass non-blocking pipe to kernel. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-255=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libsystemd0-234-lp150.20.15.1 libsystemd0-debuginfo-234-lp150.20.15.1 libsystemd0-mini-234-lp150.20.15.1 libsystemd0-mini-debuginfo-234-lp150.20.15.1 libudev-devel-234-lp150.20.15.1 libudev-mini-devel-234-lp150.20.15.1 libudev-mini1-234-lp150.20.15.1 libudev-mini1-debuginfo-234-lp150.20.15.1 libudev1-234-lp150.20.15.1 libudev1-debuginfo-234-lp150.20.15.1 nss-myhostname-234-lp150.20.15.1 nss-myhostname-debuginfo-234-lp150.20.15.1 nss-mymachines-234-lp150.20.15.1 nss-mymachines-debuginfo-234-lp150.20.15.1 nss-systemd-234-lp150.20.15.1 nss-systemd-debuginfo-234-lp150.20.15.1 systemd-234-lp150.20.15.1 systemd-container-234-lp150.20.15.1 systemd-container-debuginfo-234-lp150.20.15.1 systemd-coredump-234-lp150.20.15.1 systemd-coredump-debuginfo-234-lp150.20.15.1 systemd-debuginfo-234-lp150.20.15.1 systemd-debugsource-234-lp150.20.15.1 systemd-devel-234-lp150.20.15.1 systemd-logger-234-lp150.20.15.1 systemd-mini-234-lp150.20.15.1 systemd-mini-container-mini-234-lp150.20.15.1 systemd-mini-container-mini-debuginfo-234-lp150.20.15.1 systemd-mini-coredump-mini-234-lp150.20.15.1 systemd-mini-coredump-mini-debuginfo-234-lp150.20.15.1 systemd-mini-debuginfo-234-lp150.20.15.1 systemd-mini-debugsource-234-lp150.20.15.1 systemd-mini-devel-234-lp150.20.15.1 systemd-mini-sysvinit-234-lp150.20.15.1 systemd-sysvinit-234-lp150.20.15.1 udev-234-lp150.20.15.1 udev-debuginfo-234-lp150.20.15.1 udev-mini-234-lp150.20.15.1 udev-mini-debuginfo-234-lp150.20.15.1 - openSUSE Leap 15.0 (noarch): systemd-bash-completion-234-lp150.20.15.1 systemd-mini-bash-completion-234-lp150.20.15.1 - openSUSE Leap 15.0 (x86_64): libsystemd0-32bit-234-lp150.20.15.1 libsystemd0-32bit-debuginfo-234-lp150.20.15.1 libudev-devel-32bit-234-lp150.20.15.1 libudev1-32bit-234-lp150.20.15.1 libudev1-32bit-debuginfo-234-lp150.20.15.1 nss-myhostname-32bit-234-lp150.20.15.1 nss-myhostname-32bit-debuginfo-234-lp150.20.15.1 nss-mymachines-32bit-234-lp150.20.15.1 nss-mymachines-32bit-debuginfo-234-lp150.20.15.1 systemd-32bit-234-lp150.20.15.1 systemd-32bit-debuginfo-234-lp150.20.15.1 References: https://www.suse.com/security/cve/CVE-2019-6454.html https://bugzilla.suse.com/1117025 https://bugzilla.suse.com/1121563 https://bugzilla.suse.com/1122000 https://bugzilla.suse.com/1123333 https://bugzilla.suse.com/1123727 https://bugzilla.suse.com/1123892 https://bugzilla.suse.com/1124153 https://bugzilla.suse.com/1125352 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0251-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 27 Feb '19

27 Feb '19

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0251-1 Rating: important References: #1119105 #1122983 #1125330 Cross-References: CVE-2016-5824 CVE-2018-12405 CVE-2018-17466 CVE-2018-18335 CVE-2018-18356 CVE-2018-18492 CVE-2018-18493 CVE-2018-18494 CVE-2018-18498 CVE-2018-18500 CVE-2018-18501 CVE-2018-18505 CVE-2018-18509 CVE-2019-5785 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 60.5.1 fixes the following issues: Security vulnerabilities addressed (MSFA 2019-03 MSFA 2018-31 MFSA 2019-06 bsc#1122983 bsc#1119105 bsc#1125330): - CVE-2018-18356: Fixed a Use-after-free in Skia. - CVE-2019-5785: Fixed an Integer overflow in Skia. - CVE-2018-18335: Fixed a Buffer overflow in Skia by default deactivating Canvas 2D. This issue does not affect Linuc distributions. - CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures showing mistekenly that emails bring a valid sugnature. - CVE-2018-18500: Use-after-free parsing HTML5 stream - CVE-2018-18505: Privilege escalation through IPC channel messages - CVE-2016-5824 DoS (use-after-free) via a crafted ics file - CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 - CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11 - CVE-2018-18492: Use-after-free with select element - CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia - CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs - CVE-2018-18498: Integer overflow when calculating buffer sizes for images - CVE-2018-12405: Memory safety bugs fixed in Firefox 64, 60.4, and Thunderbird 60.4 Other bug fixes and changes: - FileLink provider WeTransfer to upload large attachments - Thunderbird now allows the addition of OpenSearch search engines from a local XML file using a minimal user interface: [+] button to select a file an add, [-] to remove. - More search engines: Google and DuckDuckGo available by default in some locales - During account creation, Thunderbird will now detect servers using the Microsoft Exchange protocol. It will offer the installation of a 3rd party add-on (Owl) which supports that protocol. - Thunderbird now compatible with other WebExtension-based FileLink add-ons like the Dropbox add-on - New WebExtensions FileLink API to facilitate add-ons - Fix decoding problems for messages with less common charsets (cp932, cp936) - New messages in the drafts folder (and other special or virtual folders) will no longer be included in the new messages notification - Thunderbird 60 will migrate security databases (key3.db, cert8.db to key4.db, cert9.db). - Address book search and auto-complete slowness - Plain text markup with * for bold, / for italics, _ for underline and | for code did not work when the enclosed text contained non-ASCII characters - While composing a message, a link not removed when link location was removed in the link properties panel - Encoding problems when exporting address books or messages using the system charset. Messages are now always exported using the UTF-8 encoding - If the "Date" header of a message was invalid, Jan 1970 or Dec 1969 was displayed. Now using date from "Received" header instead. - Body search/filtering didn't reliably ignore content of tags - Inappropriate warning "Thunderbird prevented the site (addons.thunderbird.net) from asking you to install software on your computer" when installing add-ons - Incorrect display of correspondents column since own email address was not always detected - Spurious 
 (encoded newline) inserted into drafts and sent email - Double-clicking on a word in the Write window sometimes launched the Advanced Property Editor or Link Properties dialog - Fixed Cookie removal - "Download rest of message" was not working if global inbox was used - Fix Encoding problems for users (especially in Poland) when a file was sent via a folder using "Sent to > Mail recipient" due to a problem in the Thunderbird MAPI interface - According to RFC 4616 and RFC 5721, passwords containing non-ASCII characters are encoded using UTF-8 which can lead to problems with non-compliant providers, for example office365.com. The SMTP LOGIN and POP3 USER/PASS authentication methods are now using a Latin-1 encoding again to work around this issue - Fix shutdown crash/hang after entering an empty IMAP password This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-251=1 Package List: - openSUSE Leap 15.0 (x86_64): MozillaThunderbird-60.5.1-lp150.3.30.1 MozillaThunderbird-buildsymbols-60.5.1-lp150.3.30.1 MozillaThunderbird-debuginfo-60.5.1-lp150.3.30.1 MozillaThunderbird-debugsource-60.5.1-lp150.3.30.1 MozillaThunderbird-translations-common-60.5.1-lp150.3.30.1 MozillaThunderbird-translations-other-60.5.1-lp150.3.30.1 References: https://www.suse.com/security/cve/CVE-2016-5824.html https://www.suse.com/security/cve/CVE-2018-12405.html https://www.suse.com/security/cve/CVE-2018-17466.html https://www.suse.com/security/cve/CVE-2018-18335.html https://www.suse.com/security/cve/CVE-2018-18356.html https://www.suse.com/security/cve/CVE-2018-18492.html https://www.suse.com/security/cve/CVE-2018-18493.html https://www.suse.com/security/cve/CVE-2018-18494.html https://www.suse.com/security/cve/CVE-2018-18498.html https://www.suse.com/security/cve/CVE-2018-18500.html https://www.suse.com/security/cve/CVE-2018-18501.html https://www.suse.com/security/cve/CVE-2018-18505.html https://www.suse.com/security/cve/CVE-2018-18509.html https://www.suse.com/security/cve/CVE-2019-5785.html https://bugzilla.suse.com/1119105 https://bugzilla.suse.com/1122983 https://bugzilla.suse.com/1125330 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0249-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 26 Feb '19

26 Feb '19

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0249-1 Rating: important References: #1122983 #1125330 Cross-References: CVE-2016-5824 CVE-2018-12405 CVE-2018-17466 CVE-2018-18335 CVE-2018-18356 CVE-2018-18492 CVE-2018-18493 CVE-2018-18494 CVE-2018-18498 CVE-2018-18500 CVE-2018-18501 CVE-2018-18505 CVE-2018-18509 CVE-2019-5785 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 60.5.1 fixes the following issues: Security vulnerabilities addressed (MFSA 2019-03 MFSA 2018-31 bsc#1122983 and MFSA 2019-06 bsc#1125330): - CVE-2018-18356: Fixed a Use-after-free in Skia. - CVE-2019-5785: Fixed an Integer overflow in Skia. - CVE-2018-18335: Fixed a Buffer overflow in Skia by default deactivating Canvas 2D. This issue does not affect Linuc distributions. - CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures showing mistekenly that emails bring a valid sugnature. - CVE-2018-18500: Use-after-free parsing HTML5 stream - CVE-2018-18505: Privilege escalation through IPC channel messages - CVE-2016-5824: DoS (use-after-free) via a crafted ics file - CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 - CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11 - CVE-2018-18492: Use-after-free with select element - CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia - CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs - CVE-2018-18498: Integer overflow when calculating buffer sizes for images - CVE-2018-12405: Memory safety bugs Other bug fixes and changes: * FileLink provider WeTransfer to upload large attachments * Thunderbird now allows the addition of OpenSearch search engines from a local XML file using a minimal user inferface: [+] button to select a file an add, [-] to remove. * More search engines: Google and DuckDuckGo available by default in some locales * During account creation, Thunderbird will now detect servers using the Microsoft Exchange protocol. It will offer the installation of a 3rd party add-on (Owl) which supports that protocol. * Thunderbird now compatible with other WebExtension-based FileLink add-ons like the Dropbox add-on * New WebExtensions FileLink API to facilitate add-ons * Fix decoding problems for messages with less common charsets (cp932, cp936) * New messages in the drafts folder (and other special or virtual folders) will no longer be included in the new messages notification * Thunderbird 60 will migrate security databases (key3.db, cert8.db to key4.db, cert9.db). Thunderbird 60.3.2 and earlier contained a fault that potentially deleted saved passwords and private certificate keys for users using a master password. Version 60.3.3 will prevent the loss of data; affected users who have already upgraded to version 60.3.2 or earlier can restore the deleted key3.db file from backup to complete the migration. * Address book search and auto-complete slowness introduced in Thunderbird 60.3.2 * Plain text markup with * for bold, / for italics, _ for underline and | for code did not work when the enclosed text contained non-ASCII characters * While composing a message, a link not removed when link location was removed in the link properties panel * Encoding problems when exporting address books or messages using the system charset. Messages are now always exported using the UTF-8 encoding * If the "Date" header of a message was invalid, Jan 1970 or Dec 1969 was displayed. Now using date from "Received" header instead. * Body search/filtering didn't reliably ignore content of tags * Inappropriate warning "Thunderbird prevented the site (addons.thunderbird.net) from asking you to install software on your computer" when installing add-ons * Incorrect display of correspondents column since own email address was not always detected * Spurious 
 (encoded newline) inserted into drafts and sent email * Double-clicking on a word in the Write window sometimes launched the Advanced Property Editor or Link Properties dialog * Fixe Cookie removal * "Download rest of message" was not working if global inbox was used * Fix Encoding problems for users (especially in Poland) when a file was sent via a folder using "Sent to > Mail recipient" due to a problem in the Thunderbird MAPI interface * According to RFC 4616 and RFC 5721, passwords containing non-ASCII characters are encoded using UTF-8 which can lead to problems with non-compliant providers, for example office365.com. The SMTP LOGIN and POP3 USER/PASS authentication methods are now using a Latin-1 encoding again to work around this issue * Fix shutdown crash/hang after entering an empty IMAP password Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-249=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-60.5.1-79.1 MozillaThunderbird-buildsymbols-60.5.1-79.1 MozillaThunderbird-translations-common-60.5.1-79.1 MozillaThunderbird-translations-other-60.5.1-79.1 References: https://www.suse.com/security/cve/CVE-2016-5824.html https://www.suse.com/security/cve/CVE-2018-12405.html https://www.suse.com/security/cve/CVE-2018-17466.html https://www.suse.com/security/cve/CVE-2018-18335.html https://www.suse.com/security/cve/CVE-2018-18356.html https://www.suse.com/security/cve/CVE-2018-18492.html https://www.suse.com/security/cve/CVE-2018-18493.html https://www.suse.com/security/cve/CVE-2018-18494.html https://www.suse.com/security/cve/CVE-2018-18498.html https://www.suse.com/security/cve/CVE-2018-18500.html https://www.suse.com/security/cve/CVE-2018-18501.html https://www.suse.com/security/cve/CVE-2018-18505.html https://www.suse.com/security/cve/CVE-2018-18509.html https://www.suse.com/security/cve/CVE-2019-5785.html https://bugzilla.suse.com/1122983 https://bugzilla.suse.com/1125330 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0248-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 26 Feb '19

26 Feb '19

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0248-1 Rating: important References: #1125330 Cross-References: CVE-2018-18356 CVE-2019-5785 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for MozillaFirefox to version 60.5.1esr fixes the following issues: Security vulnerabilities addressed (MFSA-2019-05, boo#1125330): - CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library that could occur when creating a path, leading to a potentially exploitable crash. - CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library that could occur after specific transform operations, leading to a potentially exploitable crash. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-248=1 Package List: - openSUSE Leap 15.0 (x86_64): MozillaFirefox-60.5.1-lp150.3.39.2 MozillaFirefox-branding-upstream-60.5.1-lp150.3.39.2 MozillaFirefox-buildsymbols-60.5.1-lp150.3.39.2 MozillaFirefox-debuginfo-60.5.1-lp150.3.39.2 MozillaFirefox-debugsource-60.5.1-lp150.3.39.2 MozillaFirefox-devel-60.5.1-lp150.3.39.2 MozillaFirefox-translations-common-60.5.1-lp150.3.39.2 MozillaFirefox-translations-other-60.5.1-lp150.3.39.2 References: https://www.suse.com/security/cve/CVE-2018-18356.html https://www.suse.com/security/cve/CVE-2019-5785.html https://bugzilla.suse.com/1125330 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0250-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 26 Feb '19

26 Feb '19

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0250-1 Rating: important References: #1125330 Cross-References: CVE-2018-18335 CVE-2018-18356 CVE-2018-18509 CVE-2019-5785 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for MozillaThunderbird to version 60.5.1 fixes the following issues: Security issues fixed (MFSA 2019-06 bsc#1125330): - CVE-2018-18356: Fixed a Use-after-free in Skia. - CVE-2019-5785: Fixed an Integer overflow in Skia. - CVE-2018-18335: Fixed a Buffer overflow in Skia by default deactivating Canvas 2D. This issue does not affect Linuc distributions. - CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures showing mistekenly that emails bring a valid sugnature. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-250=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaThunderbird-60.5.1-86.1 MozillaThunderbird-buildsymbols-60.5.1-86.1 MozillaThunderbird-debuginfo-60.5.1-86.1 MozillaThunderbird-debugsource-60.5.1-86.1 MozillaThunderbird-translations-common-60.5.1-86.1 MozillaThunderbird-translations-other-60.5.1-86.1 References: https://www.suse.com/security/cve/CVE-2018-18335.html https://www.suse.com/security/cve/CVE-2018-18356.html https://www.suse.com/security/cve/CVE-2018-18509.html https://www.suse.com/security/cve/CVE-2019-5785.html https://bugzilla.suse.com/1125330 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0247-1: moderate: Security update for kauth
by opensuse-security＠opensuse.org 26 Feb '19

26 Feb '19

openSUSE Security Update: Security update for kauth ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0247-1 Rating: moderate References: #1124863 Cross-References: CVE-2019-7443 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kauth fixes the following issues: Security issue fixed: - CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants (bsc#1124863). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-247=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): kauth-devel-5.45.0-bp150.3.6.1 libKF5Auth5-5.45.0-bp150.3.6.1 - openSUSE Backports SLE-15 (aarch64_ilp32): kauth-devel-64bit-5.45.0-bp150.3.6.1 libKF5Auth5-64bit-5.45.0-bp150.3.6.1 - openSUSE Backports SLE-15 (noarch): libKF5Auth5-lang-5.45.0-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-7443.html https://bugzilla.suse.com/1124863 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0242-1: moderate: Security update for kauth
by opensuse-security＠opensuse.org 25 Feb '19

25 Feb '19

openSUSE Security Update: Security update for kauth ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0242-1 Rating: moderate References: #1124863 Cross-References: CVE-2019-7443 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kauth fixes the following issues: Security issue fixed: - CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants (bsc#1124863). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-242=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-242=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-242=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-242=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): kauth-debugsource-5.32.0-3.3.1 kauth-devel-5.32.0-3.3.1 libKF5Auth5-5.32.0-3.3.1 libKF5Auth5-debuginfo-5.32.0-3.3.1 - openSUSE Leap 42.3 (noarch): libKF5Auth5-lang-5.32.0-3.3.1 - openSUSE Leap 42.3 (x86_64): kauth-devel-32bit-5.32.0-3.3.1 libKF5Auth5-32bit-5.32.0-3.3.1 libKF5Auth5-debuginfo-32bit-5.32.0-3.3.1 - openSUSE Leap 15.0 (i586 x86_64): kauth-debugsource-5.45.0-lp150.3.3.1 kauth-devel-5.45.0-lp150.3.3.1 libKF5Auth5-5.45.0-lp150.3.3.1 libKF5Auth5-debuginfo-5.45.0-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): libKF5Auth5-lang-5.45.0-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): kauth-devel-32bit-5.45.0-lp150.3.3.1 libKF5Auth5-32bit-5.45.0-lp150.3.3.1 libKF5Auth5-32bit-debuginfo-5.45.0-lp150.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): kauth-debugsource-5.45.0-bp150.3.3.1 kauth-devel-5.45.0-bp150.3.3.1 libKF5Auth5-5.45.0-bp150.3.3.1 libKF5Auth5-debuginfo-5.45.0-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): kauth-devel-64bit-5.45.0-bp150.3.3.1 libKF5Auth5-64bit-5.45.0-bp150.3.3.1 libKF5Auth5-64bit-debuginfo-5.45.0-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): libKF5Auth5-lang-5.45.0-bp150.3.3.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): kcoreaddons-5.20.0-8.1 kcoreaddons-5.32.0-7.1 kcoreaddons-debugsource-5.20.0-8.1 kcoreaddons-debugsource-5.32.0-7.1 kcoreaddons-devel-5.20.0-8.1 kcoreaddons-devel-5.32.0-7.1 kcoreaddons-devel-debuginfo-5.20.0-8.1 kcoreaddons-devel-debuginfo-5.32.0-7.1 libKF5CoreAddons5-5.20.0-8.1 libKF5CoreAddons5-5.32.0-7.1 libKF5CoreAddons5-debuginfo-5.20.0-8.1 libKF5CoreAddons5-debuginfo-5.32.0-7.1 libpolkit-qt5-1-1-0.112.0-4.1 libpolkit-qt5-1-1-0.112.0-5.1 libpolkit-qt5-1-1-debuginfo-0.112.0-4.1 libpolkit-qt5-1-1-debuginfo-0.112.0-5.1 libpolkit-qt5-1-devel-0.112.0-4.1 libpolkit-qt5-1-devel-0.112.0-5.1 polkit-qt5-1-debugsource-0.112.0-4.1 polkit-qt5-1-debugsource-0.112.0-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le x86_64): libpolkit-qt5-1-1-0.112.0-2.1 libpolkit-qt5-1-1-debuginfo-0.112.0-2.1 libpolkit-qt5-1-devel-0.112.0-2.1 polkit-qt5-1-debugsource-0.112.0-2.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le): kcoreaddons-5.26.0-5.2 kcoreaddons-debugsource-5.26.0-5.2 kcoreaddons-devel-5.26.0-5.2 kcoreaddons-devel-debuginfo-5.26.0-5.2 libKF5CoreAddons5-5.26.0-5.2 libKF5CoreAddons5-debuginfo-5.26.0-5.2 - SUSE Package Hub for SUSE Linux Enterprise 12 (ppc64le x86_64): kauth-debugsource-5.26.0-9.2 kauth-debugsource-5.32.0-5.1 kauth-devel-5.20.0-10.1 kauth-devel-5.26.0-9.2 kauth-devel-5.32.0-5.1 libKF5Auth5-5.20.0-10.1 libKF5Auth5-5.26.0-9.2 libKF5Auth5-5.32.0-5.1 libKF5Auth5-debuginfo-5.26.0-9.2 libKF5Auth5-debuginfo-5.32.0-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64_ilp32): kauth-devel-64bit-5.32.0-5.2 kcoreaddons-devel-64bit-5.32.0-7.1 kcoreaddons-devel-debuginfo-64bit-5.32.0-7.1 libKF5Auth5-64bit-5.32.0-5.2 libKF5Auth5-debuginfo-64bit-5.32.0-5.2 libKF5CoreAddons5-64bit-5.32.0-7.1 libKF5CoreAddons5-debuginfo-64bit-5.32.0-7.1 libpolkit-qt5-1-1-64bit-0.112.0-4.1 libpolkit-qt5-1-1-debuginfo-64bit-0.112.0-4.1 libpolkit-qt5-1-devel-64bit-0.112.0-4.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 s390x): kauth-debugsource-5.26.0-9.3 kauth-debugsource-5.32.0-5.2 kauth-devel-5.20.0-10.2 kauth-devel-5.26.0-9.3 kauth-devel-5.32.0-5.2 libKF5Auth5-5.20.0-10.2 libKF5Auth5-5.26.0-9.3 libKF5Auth5-5.32.0-5.2 libKF5Auth5-debuginfo-5.26.0-9.3 libKF5Auth5-debuginfo-5.32.0-5.2 - SUSE Package Hub for SUSE Linux Enterprise 12 (s390x x86_64): kcoreaddons-5.26.0-5.4 kcoreaddons-debugsource-5.26.0-5.4 kcoreaddons-devel-5.26.0-5.4 kcoreaddons-devel-debuginfo-5.26.0-5.4 libKF5CoreAddons5-5.26.0-5.4 libKF5CoreAddons5-debuginfo-5.26.0-5.4 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): kcoreaddons-lang-5.20.0-8.1 kcoreaddons-lang-5.26.0-5.2 kcoreaddons-lang-5.26.0-5.4 kcoreaddons-lang-5.32.0-7.1 libKF5Auth5-lang-5.20.0-10.1 libKF5Auth5-lang-5.20.0-10.2 libKF5Auth5-lang-5.26.0-9.2 libKF5Auth5-lang-5.26.0-9.3 libKF5Auth5-lang-5.32.0-5.1 libKF5Auth5-lang-5.32.0-5.2 - SUSE Package Hub for SUSE Linux Enterprise 12 (s390x): libpolkit-qt5-1-1-0.112.0-2.2 libpolkit-qt5-1-1-debuginfo-0.112.0-2.2 libpolkit-qt5-1-devel-0.112.0-2.2 polkit-qt5-1-debugsource-0.112.0-2.2 References: https://www.suse.com/security/cve/CVE-2019-7443.html https://bugzilla.suse.com/1124863 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0244-1: moderate: Security update for python-Jinja2
by opensuse-security＠opensuse.org 25 Feb '19

25 Feb '19

openSUSE Security Update: Security update for python-Jinja2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0244-1 Rating: moderate References: #858239 Cross-References: CVE-2014-0012 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Jinja2 fixes the following issues: - Update to 2.8 - Added `target` parameter to urlize function. - Added support for `followsymlinks` to the file system loader. - The truncate filter now counts the length. - Added equalto filter that helps with select filters. - Changed cache keys to use absolute file names if available instead of load names. - Fixed loop length calculation for some iterators. - Changed how Jinja2 enforces strings to be native strings in Python 2 to work when people break their default encoding. - Added :func:`make_logging_undefined` which returns an undefined object that logs failures into a logger. - If unmarshalling of cached data fails the template will be reloaded now. - Implemented a block ``set`` tag. - Default cache size was incrased to 400 from a low 50. - Fixed ``is number`` test to accept long integers in all Python versions. - Changed ``is number`` to accept Decimal as a number. - Added a check for default arguments followed by non-default arguments. This change makes ``{% macro m(x, y=1, z) %}...{% endmacro %}`` a syntax error. The previous behavior for this code was broken anyway (resulting in the default value being applied to `y`). - Add ability to use custom subclasses of ``jinja2.compiler.CodeGenerator`` and ``jinja2.runtime.Context`` by adding two new attributes to the environment (`code_generator_class` and `context_class`) (pull request ``#404``). - added support for context/environment/evalctx decorator functions on the finalize callback of the environment. - escape query strings for urlencode properly. Previously slashes were not escaped in that place. - Add 'base' parameter to 'int' filter. - Tests are removed from the package (not distributed in the tar.gz) - Use %python_version over %py_ver: better portability to RHEL - run testsuite during build - adjust dependency to use up to date package name for python-MarkupSafe - Update to 2.7.3 (boo#858239, CVE-2014-0012) - Security issue: Corrected the security fix for the cache folder. This fix was provided by RedHat. - fix package build (file selection missing) - avoid rebuildcycle with vim - update to 2.7.2: - Prefix loader was not forwarding the locals properly to inner loaders. This is now fixed. - Security issue: Changed the default folder for the filesystem cache to be user specific and read and write protected on UNIX systems. See `Debian bug 734747`_ for more information. - Require python-setuptools instead of distribute (upstreams merged) - Avoid "Recommends:" on old rpm distros - update to 2.7.1: - Fixed a bug with ``call_filter`` not working properly on environment and context filters. - Fixed lack of Python 3 support for bytecode caches. - Reverted support for defining blocks in included templates as this broke existing templates for users. - Fixed some warnings with hashing of undefineds and nodes if Python is run with warnings for Python 3. - Added support for properly hashing undefined objects. - Fixed a bug with the title filter not working on already uppercase strings. - update to 2.7: - Choice and prefix loaders now dispatch source and template lookup separately in order to work in combination with module loaders as advertised. - Fixed filesizeformat. - Added a non-silent option for babel extraction. - Added `urlencode` filter that automatically quotes values for URL safe usage with utf-8 as only supported encoding. If applications want to change this encoding they can override the filter. - Added `keep-trailing-newline` configuration to environments and templates to optionally preserve the final trailing newline. - Accessing `last` on the loop context no longer causes the iterator to be consumed into a list. - Python requirement changed: 2.6, 2.7 or >= 3.3 are required now, supported by same source code, using the "six" compatibility library. - Allow `contextfunction` and other decorators to be applied to `__call__`. - Added support for changing from newline to different signs in the `wordwrap` filter. - Added support for ignoring memcache errors silently. - Added support for keeping the trailing newline in templates. - Added finer grained support for stripping whitespace on the left side of blocks. - Added `map`, `select`, `reject`, `selectattr` and `rejectattr` filters. - Added support for `loop.depth` to figure out how deep inside a recursive loop the code is. - Disabled py_compile for pypy and python 3. - Fix building python 3 package on openSUSE 11.4 x86_64 - Add 2to3 buildrequires to allow for proper conversion of python 3 version - Add python 3 package - Simplify vim plugin packaging - Add suggests for vim and emacs in their respective packages - Removed test for obsolete openSUSE version - Simplified macro usage - Split of 'vim' and 'emacs' sub-packages that contain syntax highlighting support for both editors - Set license to BSD-3-Clause (SPDX style) - Require python-distribute instead of python-setuptools - Update to version 2.6: * internal attributes now raise an internal attribute error now instead of returning an undefined. This fixes problems when passing undefined objects to Python semantics expecting APIs. * traceback support now works properly for PyPy. (Tested with 1.4) * implemented operator intercepting for sandboxed environments. This allows application developers to disable builtin operators for better security. (For instance limit the mathematical operators to actual integers instead of longs) * groupby filter now supports dotted notation for grouping by attributes of attributes. * scoped blocks not properly treat toplevel assignments and imports. Previously an import suddenly "disappeared" in a scoped block. * automatically detect newer Python interpreter versions before loading code from bytecode caches to prevent segfaults on invalid opcodes. The segfault in earlier Jinja2 versions here was not a Jinja2 bug but a limitation in the underlying Python interpreter. If you notice Jinja2 segfaulting in earlier versions after an upgrade of the Python interpreter you don't have to upgrade, it's enough to flush the bytecode cache. This just no longer makes this necessary, Jinja2 will automatically detect these cases now. * the sum filter can now sum up values by attribute. This is a backwards incompatible change. The argument to the filter previously was the optional starting index which defaultes to zero. This now became the second argument to the function because it's rarely used. * like sum, sort now also makes it possible to order items by attribute. * like sum and sort, join now also is able to join attributes of objects as string. * the internal eval context now has a reference to the environment. * added a mapping test to see if an object is a dict or an object with a similar interface. - Renamed to python-Jinja2 - Fix wrong EOL encodings - Do not require python-setuptools, buildrequires is sufficient - Removed authors from description - Changed license to BSD3c - rpmlint issues cleanup * fdupes, tar.bz2 tarball, ... - package docs again (lost with last revision) - re-generated spec file with py2pack * now builds for Fedora and Mandriva - Update to 2.2.1; - Fixed changes file name. - initial package (2.1.1) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-244=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): python-Jinja2-2.8-2.1 python-Jinja2-emacs-2.8-2.1 python-Jinja2-vim-2.8-2.1 References: https://www.suse.com/security/cve/CVE-2014-0012.html https://bugzilla.suse.com/858239 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0243-1: moderate: Security update for dovecot23
by opensuse-security＠opensuse.org 25 Feb '19

25 Feb '19

openSUSE Security Update: Security update for dovecot23 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0243-1 Rating: moderate References: #1119850 #1123022 #1124356 Cross-References: CVE-2019-3814 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for dovecot23 fixes the following issues: dovecot was updated to 2.3.3 release, bringing lots of bugfixes (bsc#1124356). Also the following security issue was fixed: - CVE-2019-3814: A vulnerability in Dovecot related to SSL client certificate authentication was fixed (bsc#1123022) The package changes: Updated pigeonhole to 0.5.3: - Fix assertion panic occurring when managesieve service fails to open INBOX while saving a Sieve script. This was caused by a lack of cleanup after failure. - Fix specific messages causing an assert panic with actions that compose a reply (e.g. vacation). With some rather weird input from the original message, the header folding algorithm (as used for composing the References header for the reply) got confused, causing the panic. - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command parsing. After finishing reading the Sieve script, the command parsing sometimes didn't continue with the search arguments. This is a time- critical bug that likely only occurs when the Sieve script is sent in the next TCP frame. dovecot23 was updated to 2.3.3: - doveconf hides more secrets now in the default output. - ssl_dh setting is no longer enforced at startup. If it's not set and non-ECC DH key exchange happens, error is logged and client is disconnected. - Added log_debug=<filter> setting. - Added log_core_filter=<log filter> setting. - quota-clone: Write to dict asynchronously - --enable-hardening attempts to use retpoline Spectre 2 mitigations - lmtp proxy: Support source_ip passdb extra field. - doveadm stats dump: Support more fields and output stddev by default. - push-notification: Add SSL support for OX backend. - NUL bytes in mail headers can cause truncated replies when fetched. - director: Conflicting host up/down state changes may in some rare situations ended up in a loop of two directors constantly overwriting each others' changes. - director: Fix hang/crash when multiple doveadm commands are being handled concurrently. - director: Fix assert-crash if doveadm disconnects too early - virtual plugin: Some searches used 100% CPU for many seconds - dsync assert-crashed with acl plugin in some situations. (bsc#1119850) - mail_attachment_detection_options=add-flags-on-save assert-crashed with some specific Sieve scripts. - Mail snippet generation crashed with mails containing invalid Content-Type:multipart header. - Log prefix ordering was different for some log lines. - quota: With noenforcing option current quota usage wasn't updated. - auth: Kerberos authentication against Samba assert-crashed. - stats clients were unnecessarily chatty with the stats server. - imapc: Fixed various assert-crashes when reconnecting to server. - lmtp, submission: Fix potential crash if client disconnects while handling a command. - quota: Fixed compiling with glibc-2.26 / support libtirpc. - fts-solr: Empty search values resulted in 400 Bad Request errors - fts-solr: default_ns parameter couldn't be used - submission server crashed if relay server returned over 7 lines in a reply (e.g. to EHLO) dovecot was updated to 2.3.2.1: - SSL/TLS servers may have crashed during client disconnection - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have sometimes assert-crashed. - v2.3.2: "make check" may have crashed with 32bit systems dovecot was updated to 2.3.2: - old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE while opening /proc/self/io. This may still cause security problems if the process is ptrace()d at the same time. Instead, open it while still running as root. - doveadm: Added mailbox cache decision&remove commands. See doveadm-mailbox(1) man page for details. - doveadm: Added rebuild attachments command for rebuilding $HasAttachment or $HasNoAttachment flags for matching mails. See doveadm-rebuild(1) man page for details. - cassandra: Use fallback_consistency on more types of errors - lmtp proxy: Support outgoing SSL/TLS connections - lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings. - submission: Add support for rawlog_dir - submission: Add submission_client_workarounds setting. - lua auth: Add password_verify() function and additional fields in auth request. - doveadm-server: TCP connections are hanging when there is a lot of network output. This especially caused hangs in dsync-replication. - Using multiple type=shared mdbox namespaces crashed - mail_fsync setting was ignored. It was always set to "optimized". - lua auth: Fix potential crash at deinit - SSL/TLS servers may have crashed if client disconnected during handshake. - SSL/TLS servers: Don't send extraneous certificates to client when alt certs are used. - lda, lmtp: Return-Path header without '<' may have assert-crashed. - lda, lmtp: Unencoded UTF-8 in email address headers may assert-crash - lda: -f parameter didn't allow empty/null/domainless address - lmtp, submission: Message size limit was hardcoded to 40 MB. Exceeding it caused the connection to get dropped during transfer. - lmtp: Fix potential crash when delivery fails at DATA stage - lmtp: login_greeting setting was ignored - Fix to work with OpenSSL v1.0.2f - systemd unit restrictions were too strict by default - Fix potential crashes when a lot of log output was produced - SMTP client may have assert-crashed when sending mail - IMAP COMPRESS: Send "end of compression" marker when disconnecting. - cassandra: Fix consistency=quorum to work - dsync: Lock file generation failed if home directory didn't exist - Snippet generation for HTML mails didn't ignore &entities inside blockquotes, producing strange looking snippets. - imapc: Fix assert-crash if getting disconnected and after reconnection all mails in the selected mailbox are gone. - pop3c: Handle unexpected server disconnections without assert-crash - fts: Fixes to indexing mails via virtual mailboxes. - fts: If mails contained NUL characters, the text around it wasn't indexed. - Obsolete dovecot.index.cache offsets were sometimes used. Trying to fetch a field that was just added to cache file may not have always found it. pigeonhole was updated to 0.5.2: - Implement plugin for the a vendor-defined IMAP capability called "FILTER=SIEVE". It adds the ability to manually invoke Sieve filtering in IMAP. More information can be found in doc/plugins/imap_filter_sieve.txt. - The Sieve addess test caused an assertion panic for invalid addresses with UTF-8 codepoints in the localpart. Fixed by properly detecting invalid addresses with UTF-8 codepoints in the localpart and skipping these like other invalid addresses while iterating addresses for the address test. - Make the length of the subject header for the vacation response configurable and enforce the limit in UTF-8 codepoints rather than bytes. The subject header for a vacation response was statically truncated to 256 bytes, which is too limited for multi-byte UTF-8 characters. - Sieve editheader extension: Fix assertion panic occurring when it is used to manipulate a message header with a very large header field. - Properly abort execution of the sieve_discard script upon error. Before, the LDA Sieve plugin attempted to execute the sieve_discard script when an error occurs. This can lead to the message being lost. - Fix the interaction between quota and the sieve_discard script. When quota was used together with a sieve_discard script, the message delivery did not bounce when the quota was exceeded. - Fix crash for over quota users This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-243=1 Package List: - openSUSE Leap 15.0 (x86_64): dovecot23-2.3.3-lp150.3.3.1 dovecot23-backend-mysql-2.3.3-lp150.3.3.1 dovecot23-backend-mysql-debuginfo-2.3.3-lp150.3.3.1 dovecot23-backend-pgsql-2.3.3-lp150.3.3.1 dovecot23-backend-pgsql-debuginfo-2.3.3-lp150.3.3.1 dovecot23-backend-sqlite-2.3.3-lp150.3.3.1 dovecot23-backend-sqlite-debuginfo-2.3.3-lp150.3.3.1 dovecot23-debuginfo-2.3.3-lp150.3.3.1 dovecot23-debugsource-2.3.3-lp150.3.3.1 dovecot23-devel-2.3.3-lp150.3.3.1 dovecot23-fts-2.3.3-lp150.3.3.1 dovecot23-fts-debuginfo-2.3.3-lp150.3.3.1 dovecot23-fts-lucene-2.3.3-lp150.3.3.1 dovecot23-fts-lucene-debuginfo-2.3.3-lp150.3.3.1 dovecot23-fts-solr-2.3.3-lp150.3.3.1 dovecot23-fts-solr-debuginfo-2.3.3-lp150.3.3.1 dovecot23-fts-squat-2.3.3-lp150.3.3.1 dovecot23-fts-squat-debuginfo-2.3.3-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-3814.html https://bugzilla.suse.com/1119850 https://bugzilla.suse.com/1123022 https://bugzilla.suse.com/1124356 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0245-1: important: Security update for python-numpy
by opensuse-security＠opensuse.org 25 Feb '19

25 Feb '19

openSUSE Security Update: Security update for python-numpy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0245-1 Rating: important References: #1122208 Cross-References: CVE-2019-6446 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-numpy fixes the following issue: Security issue fixed: - CVE-2019-6446: Set allow_pickle to false by default to restrict loading untrusted content (bsc#1122208). With this update we decrease the possibility of allowing remote attackers to execute arbitrary code by misusing numpy.load(). A warning during runtime will show-up when the allow_pickle is not explicitly set. NOTE: By applying this update the behavior of python-numpy changes, which might break your application. In order to get the old behaviour back, you have to explicitly set `allow_pickle` to True. Be aware that this should only be done for trusted input, as loading untrusted input might lead to arbitrary code execution. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-245=1 Package List: - openSUSE Leap 15.0 (x86_64): python-numpy-debuginfo-1.14.0-lp150.3.3.1 python-numpy-debugsource-1.14.0-lp150.3.3.1 python-numpy_1_14_0-gnu-hpc-debuginfo-1.14.0-lp150.3.3.1 python-numpy_1_14_0-gnu-hpc-debugsource-1.14.0-lp150.3.3.1 python2-numpy-1.14.0-lp150.3.3.1 python2-numpy-debuginfo-1.14.0-lp150.3.3.1 python2-numpy-devel-1.14.0-lp150.3.3.1 python2-numpy-gnu-hpc-1.14.0-lp150.3.3.1 python2-numpy-gnu-hpc-devel-1.14.0-lp150.3.3.1 python2-numpy_1_14_0-gnu-hpc-1.14.0-lp150.3.3.1 python2-numpy_1_14_0-gnu-hpc-debuginfo-1.14.0-lp150.3.3.1 python2-numpy_1_14_0-gnu-hpc-devel-1.14.0-lp150.3.3.1 python3-numpy-1.14.0-lp150.3.3.1 python3-numpy-debuginfo-1.14.0-lp150.3.3.1 python3-numpy-devel-1.14.0-lp150.3.3.1 python3-numpy-gnu-hpc-1.14.0-lp150.3.3.1 python3-numpy-gnu-hpc-devel-1.14.0-lp150.3.3.1 python3-numpy_1_14_0-gnu-hpc-1.14.0-lp150.3.3.1 python3-numpy_1_14_0-gnu-hpc-debuginfo-1.14.0-lp150.3.3.1 python3-numpy_1_14_0-gnu-hpc-devel-1.14.0-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-6446.html https://bugzilla.suse.com/1122208 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0242-1: moderate: Security update for kauth
by opensuse-security＠opensuse.org 25 Feb '19

25 Feb '19

openSUSE Security Update: Security update for kauth ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0242-1 Rating: moderate References: #1124863 Cross-References: CVE-2019-7443 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kauth fixes the following issues: Security issue fixed: - CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants (bsc#1124863). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-242=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-242=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-242=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): kauth-debugsource-5.32.0-3.3.1 kauth-devel-5.32.0-3.3.1 libKF5Auth5-5.32.0-3.3.1 libKF5Auth5-debuginfo-5.32.0-3.3.1 - openSUSE Leap 42.3 (x86_64): kauth-devel-32bit-5.32.0-3.3.1 libKF5Auth5-32bit-5.32.0-3.3.1 libKF5Auth5-debuginfo-32bit-5.32.0-3.3.1 - openSUSE Leap 42.3 (noarch): libKF5Auth5-lang-5.32.0-3.3.1 - openSUSE Leap 15.0 (i586 x86_64): kauth-debugsource-5.45.0-lp150.3.3.1 kauth-devel-5.45.0-lp150.3.3.1 libKF5Auth5-5.45.0-lp150.3.3.1 libKF5Auth5-debuginfo-5.45.0-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): libKF5Auth5-lang-5.45.0-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): kauth-devel-32bit-5.45.0-lp150.3.3.1 libKF5Auth5-32bit-5.45.0-lp150.3.3.1 libKF5Auth5-32bit-debuginfo-5.45.0-lp150.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): kauth-debugsource-5.45.0-bp150.3.3.1 kauth-devel-5.45.0-bp150.3.3.1 libKF5Auth5-5.45.0-bp150.3.3.1 libKF5Auth5-debuginfo-5.45.0-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): kauth-devel-64bit-5.45.0-bp150.3.3.1 libKF5Auth5-64bit-5.45.0-bp150.3.3.1 libKF5Auth5-64bit-debuginfo-5.45.0-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): libKF5Auth5-lang-5.45.0-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-7443.html https://bugzilla.suse.com/1124863 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0240-1: moderate: Security update for pspp, spread-sheet-widget
by opensuse-security＠opensuse.org 24 Feb '19

24 Feb '19

openSUSE Security Update: Security update for pspp, spread-sheet-widget ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0240-1 Rating: moderate References: #1120061 Cross-References: CVE-2018-20230 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pspp to version 1.2.0 fixes the following issues: Security issue fixed: - CVE-2018-20230: Fixed a heap-based buffer overflow in read_bytes_internal function that could lead to denial-of-service (bsc#1120061). Other bug fixes and changes: - Add upstream patch to avoid compiling with old Texinfo 4.13. - New experimental command SAVE DATA COLLECTION to save MDD files. - MTIME and YMDHMS variable formats now supported. - Spread sheet rendering now done via spread-sheet-widget. This update introduces a new package called spread-sheet-widget as dependency. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-240=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libspread-sheet-widget0-0.3-bp150.2.1 libspread-sheet-widget0-debuginfo-0.3-bp150.2.1 pspp-1.2.0-bp150.3.3.1 pspp-devel-1.2.0-bp150.3.3.1 spread-sheet-widget-debugsource-0.3-bp150.2.1 spread-sheet-widget-devel-0.3-bp150.2.1 References: https://www.suse.com/security/cve/CVE-2018-20230.html https://bugzilla.suse.com/1120061 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0239-1: important: Security update for python-python-gnupg
by opensuse-security＠opensuse.org 23 Feb '19

23 Feb '19

openSUSE Security Update: Security update for python-python-gnupg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0239-1 Rating: important References: #1123498 Cross-References: CVE-2019-6690 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-python-gnupg to version 0.4.4 fixes the following issues: Security issue fixed: - CVE-2019-6690: Added a check to disallow certain control characters ('\r', '\n', NUL) in passphrases (boo#1123498). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-239=1 Package List: - openSUSE Backports SLE-15 (noarch): python2-python-gnupg-0.4.4-bp150.2.3.1 python3-python-gnupg-0.4.4-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-6690.html https://bugzilla.suse.com/1123498 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0238-1: moderate: Security update for ansible
by opensuse-security＠opensuse.org 23 Feb '19

23 Feb '19

openSUSE Security Update: Security update for ansible ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0238-1 Rating: moderate References: #1056094 #1097775 Cross-References: CVE-2017-7466 CVE-2017-7481 CVE-2018-10855 CVE-2018-10875 CVE-2018-16859 CVE-2018-16876 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for ansible fixes the following issues: Security vulnerabilities fixed: - CVE-2018-16876: Respect no_log on retry and high verbosity (bsc#1118896) - CVE-2018-16859: Windows - prevent sensitive content from appearing in scriptblock logging (bsc#1116587) - CVE-2018-10855: Fixed the honouration of the no_log option with failed task iterations (boo#1097775) - CVE-2017-7466: Fixed an input validation vulnerability in Ansible's handling of data sent from client systems - CVE-2017-7481: Fixed a security issue with lookup return not tainting the jinja2 environment (bsc#1038785) Other bug fixes and changes: - Update to version 2.7.6 * Added log message at -vvvv when using netconf connection listing connection details. * Changes how ansible-connection names socket lock files. They now use the same name as the socket itself, and as such do not lock other attempts on connections to the same host, or cause issues with overly-long hostnames. * Fix mandatory statement error for junos modules (https://github.com/ansible/ansible/pull/50138) * Moved error in netconf connection plugin from at import to on connection. * This reverts some changes from commit 723daf3. If a line is found in the file, exactly or via regexp matching, it must not be added again. insertafter/insertbefore options are used only when a line is to be inserted, to specify where it must be added. * allow using openstack inventory plugin w/o a cache * callbacks - Do not filter out exception, warnings, deprecations on failure when using debug (https://github.com/ansible/ansible/issues/47576) * certificate_complete_chain - fix behavior when invalid file is parsed while reading intermediate or root certificates. * copy - Ensure that the src file contents is converted to unicode in diff information so that it is properly wrapped by AnsibleUnsafeText to prevent unexpected templating of diff data in Python3 (https://github.com/ansible/ansible/issues/45717) * correct behaviour of verify_file for vmware inventory plugin, it was always returning True * dnf - fix issue where conf_file was not being loaded properly * dnf - fix update_cache combined with install operation to not cause dnf transaction failure * docker_container - fix network_mode idempotency if the container:<container-name> form is used (as opposed to container:<container-id>) (https://github.com/ansible/ansible/issues/49794) * docker_container - warning when non-string env values are found, avoiding YAML parsing issues. Will be made an error in Ansible 2.8. (https://github.com/ansible/ansible/issues/49802) * docker_swarm_service - Document labels and container_labels with correct type. * docker_swarm_service - Document limit_memory and reserve_memory correctly on how to specify sizes. * docker_swarm_service - Document minimal API version for configs and secrets. * docker_swarm_service - fix use of Docker API so that services are not detected as present if there is an existing service whose name is a substring of the desired service * docker_swarm_service - fixing falsely reporting update_order as changed when option is not used. * document old option that was initally missed * ec2_instance now respects check mode https://github.com/ansible/ansible/pull/46774 * fix for network_cli - ansible_command_timeout not working as expected (#49466) * fix handling of firewalld port if protocol is missing * fix lastpass lookup failure on python 3 (https://github.com/ansible/ansible/issues/42062) * flatpak - Fixed Python 2/3 compatibility * flatpak - Fixed issue where newer versions of flatpak failed on flatpak removal * flatpak_remote - Fixed Python 2/3 compatibility * gcp_compute_instance - fix crash when the instance metadata is not set * grafana_dashboard - Fix a pair of unicode string handling issues with version checking (https://github.com/ansible/ansible/pull/49194) * host execution order - Fix reverse_inventory not to change the order of the items before reversing on python2 and to not backtrace on python3 * icinga2_host - fixed the issue with not working use_proxy option of the module. * influxdb_user - An unspecified password now sets the password to blank, except on existing users. This previously caused an unhandled exception. * influxdb_user - Fixed unhandled exception when using invalid login credentials (https://github.com/ansible/ansible/issues/50131) * openssl_* - fix error when path contains a file name without path. * openssl_csr - fix problem with idempotency of keyUsage option. * openssl_pkcs12 - now does proper path expansion for ca_certificates. * os_security_group_rule - os_security_group_rule doesn't exit properly when secgroup doesn't exist and state=absent (https://github.com/ansible/ansible/issues/50057) * paramiko_ssh - add auth_timeout parameter to ssh.connect when supported by installed paramiko version. This will prevent "Authentication timeout" errors when a slow authentication step (>30s) happens with a host (https://github.com/ansible/ansible/issues/42596) * purefa_facts and purefb_facts now correctly adds facts into main ansible_fact dictionary (https://github.com/ansible/ansible/pull/50349) * reboot - add appropriate commands to make the plugin work with VMware ESXi (https://github.com/ansible/ansible/issues/48425) * reboot - add support for rebooting AIX (https://github.com/ansible/ansible/issues/49712) * reboot - gather distribution information in order to support Alpine and other distributions (https://github.com/ansible/ansible/issues/46723) * reboot - search common paths for the shutdown command and use the full path to the binary rather than depending on the PATH of the remote system (https://github.com/ansible/ansible/issues/47131) * reboot - use a common set of commands for older and newer Solaris and SunOS variants (https://github.com/ansible/ansible/pull/48986) * redfish_utils - fix reference to local variable 'systems_service' * setup - fix the rounding of the ansible_memtotal_mb value on VMWare vm's (https://github.com/ansible/ansible/issues/49608) * vultr_server - fixed multiple ssh keys were not handled. * win_copy - Fix copy of a dir that contains an empty directory - https://github.com/ansible/ansible/issues/50077 * win_firewall_rule - Remove invalid 'bypass' action * win_lineinfile - Fix issue where a malformed json block was returned causing an error * win_updates - Correctly report changes on success - update to version 2.7.5 * ACME modules: improve error messages in some cases (include error returned by server). * Added unit test for VMware module_utils. * Also check stdout for interpreter errors for more intelligent messages to user * Backported support for Devuan-based distribution * Convert hostvars data in OpenShift inventory plugin to be serializable by ansible-inventory * Fix AttributeError (Python 3 only) when an exception occurs while rendering a template * Fix N3K power supply facts (https://github.com/ansible/ansible/pull/49150) * Fix NameError nxos_facts (https://github.com/ansible/ansible/pull/48981) * Fix VMware module utils for self usage. * Fix error in OpenShift inventory plugin when a pod has errored and is empty * Fix if the route table changed to none (https://github.com/ansible/ansible/pull/49533) * Fix iosxr netconf plugin response namespace (https://github.com/ansible/ansible/pull/49300) * Fix issues with nxos_install_os module for nxapi (https://github.com/ansible/ansible/pull/48811) * Fix lldp and cdp neighbors information (https://github.com/ansible/ansible/pull/48318)(https://github.com/ansible/ ansible/pull/48087)(https://github.com/ansible/ansible/pull/49024) * Fix nxos_interface and nxos_linkagg Idempotence issue (https://github.com/ansible/ansible/pull/46437) * Fix traceback when updating facts and the fact cache plugin was nonfunctional * Fix using vault encrypted data with jinja2_native (https://github.com/ansible/ansible/issues/48950) * Fixed: Make sure that the files excluded when extracting the archive are not checked. https://github.com/ansible/ansible/pull/45122 * Fixes issue where a password parameter was not set to no_log * aci_rest - Fix issue ignoring custom port * acme_account, acme_account_facts - in some cases, it could happen that the modules return information on disabled accounts accidentally returned by the ACME server. * docker_swarm - decreased minimal required API version from 1.35 to 1.25; some features require API version 1.30 though. * docker_swarm_service: fails because of default "user: root" (https://github.com/ansible/ansible/issues/49199) * ec2_metadata_facts - Parse IAM role name from the security credential field since the instance profile name is different * fix azure_rm_image module use positional parameter (https://github.com/ansible/ansible/pull/49394) * fixes an issue with dict_merge in network utils (https://github.com/ansible/ansible/pull/49474) * gcp_utils - fix google auth scoping issue with application default credentials or google cloud engine credentials. Only scope credentials that can be scoped. * mail - fix python 2.7 regression * openstack - fix parameter handling when cloud provided as dict https://github.com/ansible/ansible/issues/42858 * os_user - Include domain parameter in user deletion https://github.com/ansible/ansible/issues/42901 * os_user - Include domain parameter in user lookup https://github.com/ansible/ansible/issues/42901 * ovirt_storage_connection - comparing passwords breaks idempotency in update_check (https://github.com/ansible/ansible/issues/48933) * paramiko_ssh - improve log message to state the connection type * reboot - use IndexError instead of TypeError in exception * redis cache - Support version 3 of the redis python library (https://github.com/ansible/ansible/issues/49341) * sensu_silence - Cast int for expire field to avoid call failure to sensu API. * vmware_host_service_facts - handle exception when service package does not have package name. * win_nssm - Switched to Argv-ToString for escaping NSSM credentials (https://github.com/ansible/ansible/issues/48728) * zabbix_hostmacro - Added missing validate_certs logic for running module against Zabbix servers with untrused SSL certificates (https://github.com/ansible/ansible/issues/47611) * zabbix_hostmacro - Fixed support for user macros with context (https://github.com/ansible/ansible/issues/46953) - update to version 2.7.4 * powershell - add lib/ansible/executor/powershell to the packaging data - update to version 2.7.3 * Fix the issue that FTD HTTP API retries authentication-related HTTP requests * Fix the issue that module fails when the Swagger model does not have required fields * Fix the issue with comparing string-like objects * Fix using omit on play keywords * apt_key - Disable TTY requirement in GnuPG for the module to work correctly when SSH pipelining is enabled * better error message when bad type in config, deal with EVNAR= more gracefully * configuration retrieval would fail on non primed plugins * cs_template - Fixed a KeyError on state=extracted * docker_container - fix idempotency problems with docker-py caused by previous init idempotency fix * docker_container - fix interplay of docker-py version check with argument_spec validation improvements * docker_network - driver_options containing Python booleans would cause Docker to throw exceptions * ec2_group - Fix comparison of determining which rules to purge by ignoring descriptions * pip module - fix setuptools/distutils replacement * sysvinit - enabling a service should use "defaults" if no runlevels are specified - update to version 2.7.2 * Minor changes - update to 2.7.1 * Minor changes - update to 2.7.0 * Allow config to enable native jinja types * Remove support for simplejson * yum and dnf modules now at feature parity * Security Fix - avoid loading host/group vars from cwd when not specifying a playbook or playbook base dir * Security Fix - avoid using ansible.cfg in a world writable dir * Some connection exception would cause no_log specified on a task to be ignored (stdout info disclosure) * Fix glob path of rc.d (SUSE-specific) * Fix lambda_policy updates * Fix alt linux detection/matching - update to 2.6.4 * Add md5sum check in nxos_file_copy module * Allow arbitrary log_driver for docker_container * Fix Python2.6 regex bug terminal plugin nxos, iosxr * Fix check_mode in nxos_static_route module * Fix glob path of rc.d Some distribtuions like SUSE has the rc%.d directories under /etc/init.d * Fix network config diff issue for lines * Fixed an issue where ansible_facts.pkg_mgr would incorrectly set to zypper on Debian/Ubuntu systems that happened to have the command installed * The docker_* modules respect the DOCKER_* environment variables again * The fix for CVE-2018-10875 prints out a warning message about skipping a config file from a world writable current working directory. However, if the user is in a world writable current working directory which does not contain a config file, it should not print a warning message. This release fixes that extaneous warning. * To resolve nios_network issue where vendor-encapsulated-options can not have a use_option flag. * To resolve the issue of handling exception for Nios lookup gracefully. * always correctly template no log for tasks * ansible-galaxy - properly list all roles in roles_path * basic.py - catch ValueError in case a FIPS enabled platform raises this exception * docker_container: fixing working_dir idempotency problem * docker_container: makes unit parsing for memory sizes more consistent, and fixes idempotency problem when kernel_memory is set * fix example code for AWS lightsail documentation * fix the enable_snat parameter that is only supposed to be used by an user with the right policies. * fixes docker_container check and debug mode * improves docker_container idempotency * ios_l2_interface - fix bug when list of vlans ends with comma * ios_l2_interface - fix issue with certain interface types * ios_user - fix unable to delete user admin issue * ios_vlan - fix unable to work on certain interface types issue * nxos_facts test lldp feature and fix nxapi check_rc * nxos_interface port-channel idempotence fix for mode * nxos_linkagg mode fix * nxos_system idempotence fix * nxos_vlan refactor to support non structured output * one_host - fixes settings via environment variables * use retry_json nxos_banner * user - Strip trailing comments in /etc/default/passwd * user - when creating a new user without an expiration date, properly set no expiration rather that expirining the account * win_domain_computer - fixed deletion of computer active directory object that have dependent objects * win_domain_computer - fixed error in diff_support * win_domain_computer - fixed error when description parameter is empty * win_psexec - changed code to not escape the command option when building the args * win_uri -- Fix support for JSON output when charset is set * win_wait_for - fix issue where timeout doesn't wait unless state=drained - update to 2.6.3 * Fix lxd module to be idempotent when the given configuration for the lxd container has not changed * Fix setting value type to str to avoid conversion during template read. Fix Idempotency in case of 'no key'. * Fix the mount module's handling of swap entries in fstab * The fix for (CVE-2018-10875) prints out a warning message about skipping a config file from a world writable current working directory. However, if the user explicitly specifies that the config file should be used via the ANSIBLE_CONFIG environment variable then Ansible would honor that but still print out the warning message. This has been fixed so that Ansible honors the user's explicit wishes and does not print a warning message in that circumstance. * To fix the bug where existing host_record was deleted when existing record name is used with different IP. * VMware handle pnic in proxyswitch * fix azure security group cannot add rules when purge_rule set to false. * fix azure_rm_deployment collect tags from existing Resource Group. * fix azure_rm_loadbalancer_facts list takes at least 2 arguments. * fix for the bundled selectors module (used in the ssh and local connection plugins) when a syscall is restarted after being interrupted by a signal * get_url - fix the bug that get_url does not change mode when checksum matches * nicer error when multiprocessing breaks * openssl_certificate - Convert valid_date to bytes for conversion * openstack_inventory.py dynamic inventory file fixed the plugin to the script so that it will work with current ansible-inventory. Also redirect stdout before dumping the ouptput, because not doing so will cause JSON parse errors in some cases. * slack callback - Fix invocation by looking up data from cli.options * sysvinit module: handle values of optional parameters. Don't disable service when enabled parameter isn't set. Fix command when arguments parameter isn't set. * vars_prompt - properly template play level variables in vars_prompt * win_domain - ensure the Netlogon service is up and running after promoting host to controller * win_domain_controller - ensure the Netlogon service is up and running after promoting host to controller - update to 2.6.2 + Add text output along with structured output in nxos_facts + Allow more than one page of results by using the right pagination indicator ('NextMarker' instead of 'NextToken'). + Fix an atomic_move error that is 'true', but misleading. Now we show all 3 files involved and clarify what happened. + Fix eos_l2_interface eapi. + Fix fetching old style facts in junos_facts module + Fix get_device_info nxos zero or more whitespace regex + Fix nxos CI failures + Fix nxos_nxapi default http behavior + Fix nxos_vxlan_vtep_vni + Fix regex network_os_platform nxos + Refactor nxos cliconf get_device_info for non structured output supported devices + To fix the NoneType error raised in ios_l2_interface when Access Mode VLAN is unassigned + emtpy host/group name is an error + fix default SSL version for docker modules + fix mail module when using starttls + fix nmap config example + fix ps detection of service + fix the remote tmp folder permissions issue when becoming a non admin user + fix typoe in sysvinit that breaks update.rc-d detection + fixes docker_container compatibilty with docker-py < 2.2 + get_capabilities in nxapi module_utils should not return empty dictionary + inventory - When using an inventory directory, ensure extension comparison uses text types + ios_vlan - fix unable to identify correct vlans issue + nxos_facts warning message improved + openvswitch_db - make 'key' argument optional + pause - do not set stdout to raw mode when redirecting to a file + pause - nest try except when importing curses to gracefully fail if curses is not present + plugins/inventory/openstack.py - Do not create group with empty name if region is not set + preseve delegation info on nolog + remove ambiguity when it comes to 'the source' + remove dupes from var precedence + restores filtering out conflicting facts + user - fix bug that resulted in module always reporting a change when specifiying the home directory on FreeBSD + user - use correct attribute name in FreeBSD for creat_home + vultr - Do not fail trying to load configuration from ini files if required variables have been set as environment variables. + vyos_command correcting conditionals looping + win_chocolatey - enable TLSv1.2 support when downloading the Chocolatey installer + win_reboot - fix for handling an already scheduled reboot and other minor log formatting issues + win_reboot - fix issue when overridding connection timeout hung the post reboot uptime check + win_reboot - handle post reboots when running test_command + win_security_policy - allows an empty string to reset a policy value + win_share - discard any cmdlet output we don't use to ensure only the return json is received by Ansible + win_unzip - discard any cmdlet output we don't use to ensure only the return json is received by Ansible + win_updates - fixed module return value is lost in error in some cases + win_user - Use LogonUser to validate the password as it does not rely on SMB/RPC to be available + Security Fix - avoid loading host/group vars from cwd when not specifying a playbook or playbook base dir + Security Fix - avoid using ansible.cfg in a world writable dir. + Fix junos_config confirm commit timeout issue (https://github.com/ansible/ansible/pull/41527) + file module - The touch subcommand had its diff output broken during the 2.6.x development cycle. This is now fixed. + inventory manager - This fixes required options being populated before the inventory config file is read, so the required options may be set in the config file. + nsupdate - allow hmac-sha384 https://github.com/ansible/ansible/pull/42209 + win_domain - fixes typo in one of the AD cmdlets https://github.com/ansible/ansible/issues/41536 + win_group_membership - uses the internal Ansible SID conversion logic and uses that when comparing group membership instead of the name - use fdupes to save some space in python_sitelib - define BuildRoot on older distributions like SLE-11 - be a bit more flexible with the ending of manpage files to allow Fedora builds to succeed - updated to latest release 2.6.0 - New Plugins: + Callback: - cgroup_memory_recap - grafana_annotations - sumologic + Connection: - httpapi + Inventory: - foreman - gcp_compute - generator - nmap + Lookup: - onepassword - onepassword_raw - Modules updates too many to mention here please look at package documentation directory (/usr/share/doc/packages/.../changelogs) - bug fixes: - **Security Fix** - Some connection exceptions would cause no_log specified on a task to be ignored. If this happened, the task information, including any private information coul d have been displayed to stdout and (if enabled, not the default) logged to a log file specified in ansible.cfg's log_path. Additionally, sites which redirected stdout from ansible runs to a log file may have stored that private information onto disk that way as well. (https://github.com/ansible/ansible/pull/41414) - Changed the admin_users config option to not include "admin" by default as admin is frequently used for a non-privileged account (https://github.com/ansible/ansible/pull/41164) - Changed the output to "text" for "show vrf" command as default "json" output format with respect to "eapi" transport was failing (https://github.com/ansible/ansible/pull/41470) - Document mode=preserve for both the copy and template module - Fix added for Digital Ocean Volumes API change causing Ansible to recieve an unexpected value in the response. (https://github.com/ansible/ansible/pull/41431) - Fix an encoding issue when parsing the examples from a plugins' documentation - Fix iosxr_config module to handle route-policy, community-set, prefix-set, as-path-set and rd-set blocks. All these blocks are part of route-policy language of iosxr. - Fix mode=preserve with remote_src=True for the copy module - Implement mode=preserve for the template module - The yaml callback plugin now allows non-ascii characters to be displayed. - Various grafana_* modules - Port away from the deprecated b64encodestring function to the b64encode function instead. https://github.com/ansible/ansible/pull/38388 - added missing 'raise' to exception definition https://github.com/ansible/ansible/pull/41690 - allow custom endpoints to be used in the aws_s3 module (https://github.com/ansible/ansible/pull/36832) - allow set_options to be called multiple times https://github.com/ansible/ansible/pull/41913 - ansible-doc - fixed traceback on missing plugins (https://github.com/ansible/ansible/pull/41167) - cast the device_mapping volume size to an int in the ec2_ami module (https://github.com/ansible/ansible/pull/40938) - copy - fixed copy to only follow symlinks for files in the non-recursive case - copy module - The copy module was attempting to change the mode of files for remote_src=True even if mode was not set as a parameter. This failed on filesystems which do not have permission bits (https://github.com/ansible/ansible/pull/40099) - copy module - fixed recursive copy with relative paths (https://github.com/ansible/ansible/pull/40166) - correct debug display for all cases https://github.com/ansible/ansible/pull/41331 - correctly check hostvars for vars term https://github.com/ansible/ansible/pull/41819 - correctly handle yaml inventory files when entries are null dicts https://github.com/ansible/ansible/issues/41692 - dynamic includes - Allow inheriting attributes from static parents (https://github.com/ansible/ansible/pull/38827) - dynamic includes - Don't treat undefined vars for conditional includes as truthy (https://github.com/ansible/ansible/pull/39377) - dynamic includes - Fix IncludedFile comparison for free strategy (https://github.com/ansible/ansible/pull/37083) - dynamic includes - Improved performance by fixing re-parenting on copy (https://github.com/ansible/ansible/pull/38747) - dynamic includes - Use the copied and merged task for calculating task vars (https://github.com/ansible/ansible/pull/39762) - file - fixed the default follow behaviour of file to be true - file module - Eliminate an error if we're asked to remove a file but something removes it while we are processing the request (https://github.com/ansible/ansible/pull/39466) - file module - Fix error when recursively assigning permissions and a symlink to a nonexistent file is present in the directory tree (https://github.com/ansible/ansible/issues/39456) - file module - Fix error when running a task which assures a symlink to a nonexistent file exists for the second and subsequent times (https://github.com/ansible/ansible/issues/39558) - file module - The file module allowed the user to specify src as a parameter when state was not link or hard. This is documented as only applying to state=link or state=hard but in previous Ansible, this could have an effect in rare cornercases. For instance, "ansible -m file -a 'state=directory path=/tmp src=/var/lib'" would create /tmp/lib. This has been disabled and a warning emitted (will change to an error in Ansible-2.10). - file module - The touch subcommand had its diff output broken during the 2.6.x development cycle. This is now fixed (https://github.com/ansible/ansible/issues/41755) - fix BotoCoreError exception handling - fix apt-mark on debian6 (https://github.com/ansible/ansible/pull/41530) - fix async for the aws_s3 module by adding async support to the action plugin (https://github.com/ansible/ansible/pull/40826) - fix decrypting vault files for the aws_s3 module (https://github.com/ansible/ansible/pull/39634) - fix errors with S3-compatible APIs if they cannot use ACLs for buckets or objects - fix permission handling to try to download a file even if the user does not have permission to list all objects in the bucket - fixed config required handling, specifically for _terms in lookups https://github.com/ansible/ansible/pull/41740 - gce_net - Fix sorting of allowed ports (https://github.com/ansible/ansible/pull/41567) - group_by - support implicit localhost (https://github.com/ansible/ansible/pull/41860) - import/include - Ensure role handlers have the proper parent, allowing for correct attribute inheritance (https://github.com/ansible/ansible/pull/39426) - import_playbook - Pass vars applied to import_playbook into parsing of the playbook as they may be needed to parse the imported plays (https://github.com/ansible/ansible/pull/39521) - include_role/import_role - Don't overwrite included role handlers with play handlers on parse (https://github.com/ansible/ansible/pull/39563) - include_role/import_role - Fix parameter templating (https://github.com/ansible/ansible/pull/36372) - include_role/import_role - Use the computed role name for include_role/import_role so to diffentiate between names computed from host vars (https://github.com/ansible/ansible/pull/39516)- include_role/import_role - improved performance and recursion depth (https://github.com/ansible/ansible/pull/36470) - lineinfile - fix insertbefore when used with BOF to not insert duplicate lines (https://github.com/ansible/ansible/issues/38219) - password lookup - Do not load password lookup in network filters, allowing the password lookup to be overriden (https://github.com/ansible/ansible/pull/41907) - pause - ensure ctrl+c interrupt works in all cases (https://github.com/ansible/ansible/issues/35372) - powershell - use the tmpdir set by `remote_tmp` for become/async tasks instead of the generic $env:TEMP - https://github.com/ansible/ansible/pull/40210 - selinux - correct check mode behavior to report same changes as normal mode (https://github.com/ansible/ansible/pull/40721) - spwd - With python 3.6 spwd.getspnam returns PermissionError instead of KeyError if user does not have privileges (https://github.com/ansible/ansible/issues/39472) - synchronize - Ensure the local connection created by synchronize uses _remote_is_local=True, which causes ActionBase to build a local tmpdir (https://github.com/ansible/ansible/pull/40833) - template - Fix for encoding issues when a template path contains non-ascii characters and using the template path in ansible_managed (https://github.com/ansible/ansible/issues/27262) - template action plugin - fix the encoding of filenames to avoid tracebacks on Python2 when characters that are not present in the user's locale are present. (https://github.com/ansible/ansible/pull/39424) - user - only change the expiration time when necessary (https://github.com/ansible/ansible/issues/13235) - uses correct conn info for reset_connection https://github.com/ansible/ansible/issues/27520 - win_environment - Fix for issue where the environment value was deleted when a null value or empty string was set - https://github.com/ansible/ansible/issues/40450 - win_file - fix issue where special chars like [ and ] were not being handled correctly https://github.com/ansible/ansible/pull/37901 - win_get_url - fixed a few bugs around authentication and force no when using an FTP URL - win_iis_webapppool - redirect some module output to null so Ansible can read the output JSON https://github.com/ansible/ansible/issues/40874 - win_template - fix when specifying the dest option as a directory with and without the trailing slash https://github.com/ansible/ansible/issues/39886 - win_updates - Added the ability to run on a scheduled task for older hosts so async starts working again - https://github.com/ansible/ansible/issues/38364 - win_updates - Fix logic when using a whitelist for multiple updates - win_updates - Fix typo that hid the download error when a download failed - win_updates - Fixed issue where running win_updates on async fails without any error - windows become - Show better error messages when the become process fails - winrm - Add better error handling when the kinit process fails - winrm - allow `ansible_user` or `ansible_winrm_user` to override `ansible_ssh_user` when both are defined in an inventory - https://github.com/ansible/ansible/issues/39844 - winrm - ensure pexpect is set to not echo the input on a failure and have a manual sanity check afterwards https://github.com/ansible/ansible/issues/41865 - winrm connection plugin - Fix exception messages sometimes raising a traceback when the winrm connection plugin encounters an unrecoverable error. https://github.com/ansible/ansible/pull/39333 - xenserver_facts - ensure module works with newer versions of XenServer (https://github.com/ansible/ansible/pull/35821) - use python3 on (open)SUSE 15 or newer - Update to 2.5.5 - Changed the admin_users config option to not include "admin" by default as admin is frequently used for a non-privileged account - aws_s3 - add async support to the action plugin - aws_s3 - fix decrypting vault files - ec2_ami - cast the device_mapping volume size to an int - eos_logging - fix idempotency issues - cache plugins - A cache timeout of 0 means the cache will not expire. - ios_logging - fix idempotency issues - ios/nxos/eos_config - don't retrieve config in running_config when config is provided for diff - nxos_banner - fix multiline banner issue - nxos terminal plugin - fix output truncation - nxos_l3_interface - fix no switchport issue with loopback and svi interfaces - nxos_snapshot - fix compare_option - update to 2.2.3.0 (boo#1056094) * Various minor bug fixes Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-238=1 Package List: - openSUSE Backports SLE-15 (noarch): ansible-2.7.6-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2017-7466.html https://www.suse.com/security/cve/CVE-2017-7481.html https://www.suse.com/security/cve/CVE-2018-10855.html https://www.suse.com/security/cve/CVE-2018-10875.html https://www.suse.com/security/cve/CVE-2018-16859.html https://www.suse.com/security/cve/CVE-2018-16876.html https://bugzilla.suse.com/1056094 https://bugzilla.suse.com/1097775 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0237-1: Security update for mosquitto
by opensuse-security＠opensuse.org 23 Feb '19

23 Feb '19

openSUSE Security Update: Security update for mosquitto ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0237-1 Rating: low References: #1125019 #1125020 #1125021 Cross-References: CVE-2018-12546 CVE-2018-12550 CVE-2018-12551 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for mosquitto fixes the following issues: Security issues fixed: - CVE-2018-12546: Fixed an issue with revoked access to topics (bsc#1125019). - CVE-2018-12551: Fixed an issue which allowed malformed data in the password file to be treated as valid (bsc#1125020). - CVE-2018-12550: Fixed an an issue which treats an empty ACL file wrongly (bsc#1125021). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-237=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libmosquitto1-1.4.15-bp150.3.3.1 libmosquittopp1-1.4.15-bp150.3.3.1 mosquitto-1.4.15-bp150.3.3.1 mosquitto-clients-1.4.15-bp150.3.3.1 mosquitto-devel-1.4.15-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-12546.html https://www.suse.com/security/cve/CVE-2018-12550.html https://www.suse.com/security/cve/CVE-2018-12551.html https://bugzilla.suse.com/1125019 https://bugzilla.suse.com/1125020 https://bugzilla.suse.com/1125021 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0235-1: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 22 Feb '19

22 Feb '19

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0235-1 Rating: low References: #1124366 Cross-References: CVE-2019-7397 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issues: Security issue fixed: - CVE-2019-7397: Fixed a Memory leak in function WritePDFImage in pdf.c (bsc#1124366) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-235=1 Package List: - openSUSE Backports SLE-15 (x86_64): GraphicsMagick-1.3.29-bp150.2.15.1 GraphicsMagick-devel-1.3.29-bp150.2.15.1 libGraphicsMagick++-Q16-12-1.3.29-bp150.2.15.1 libGraphicsMagick++-devel-1.3.29-bp150.2.15.1 libGraphicsMagick-Q16-3-1.3.29-bp150.2.15.1 libGraphicsMagick3-config-1.3.29-bp150.2.15.1 libGraphicsMagickWand-Q16-2-1.3.29-bp150.2.15.1 perl-GraphicsMagick-1.3.29-bp150.2.15.1 References: https://www.suse.com/security/cve/CVE-2019-7397.html https://bugzilla.suse.com/1124366 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0233-1: Security update for mosquitto
by opensuse-security＠opensuse.org 22 Feb '19

22 Feb '19

openSUSE Security Update: Security update for mosquitto ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0233-1 Rating: low References: #1125019 #1125020 #1125021 Cross-References: CVE-2018-12546 CVE-2018-12550 CVE-2018-12551 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for mosquitto fixes the following issues: Security issues fixed: - CVE-2018-12546: Fixed an issue with revoked access to topics (bsc#1125019). - CVE-2018-12551: Fixed an issue which allowed malformed data in the password file to be treated as valid (bsc#1125020). - CVE-2018-12550: Fixed an an issue which treats an empty ACL file wrongly (bsc#1125021). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-233=1 Package List: - openSUSE Leap 15.0 (x86_64): libmosquitto1-1.4.15-lp150.2.3.1 libmosquitto1-debuginfo-1.4.15-lp150.2.3.1 libmosquittopp1-1.4.15-lp150.2.3.1 libmosquittopp1-debuginfo-1.4.15-lp150.2.3.1 mosquitto-1.4.15-lp150.2.3.1 mosquitto-clients-1.4.15-lp150.2.3.1 mosquitto-clients-debuginfo-1.4.15-lp150.2.3.1 mosquitto-debuginfo-1.4.15-lp150.2.3.1 mosquitto-debugsource-1.4.15-lp150.2.3.1 mosquitto-devel-1.4.15-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-12546.html https://www.suse.com/security/cve/CVE-2018-12550.html https://www.suse.com/security/cve/CVE-2018-12551.html https://bugzilla.suse.com/1125019 https://bugzilla.suse.com/1125020 https://bugzilla.suse.com/1125021 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0232-1: moderate: Security update for build
by opensuse-security＠opensuse.org 22 Feb '19

22 Feb '19

openSUSE Security Update: Security update for build ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0232-1 Rating: moderate References: #1069904 #1122895 Cross-References: CVE-2017-14804 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for build version 20190128 fixes the following issues: Security issue fixed: - CVE-2017-14804: Improve file name check extractbuild (bsc#1069904) Non-security issue fixed: - Add initial SLE 15 SP1 config (bsc#1122895) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-232=1 Package List: - openSUSE Leap 15.0 (noarch): build-20190128-lp150.2.3.1 build-initvm-i586-20190128-lp150.2.3.1 build-initvm-x86_64-20190128-lp150.2.3.1 build-mkbaselibs-20190128-lp150.2.3.1 build-mkdrpms-20190128-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2017-14804.html https://bugzilla.suse.com/1069904 https://bugzilla.suse.com/1122895 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0234-1: important: Security update for nodejs6
by opensuse-security＠opensuse.org 22 Feb '19

22 Feb '19

openSUSE Security Update: Security update for nodejs6 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0234-1 Rating: important References: #1113534 #1113652 #1117625 #1117626 #1117627 #1117629 #1117630 Cross-References: CVE-2018-0734 CVE-2018-12116 CVE-2018-12120 CVE-2018-12121 CVE-2018-12122 CVE-2018-12123 CVE-2018-5407 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for nodejs6 to version 6.16.0 fixes the following issues: Security issues fixed: - CVE-2018-0734: Fixed a timing vulnerability in the DSA signature generation (bsc#1113652) - CVE-2018-5407: Fixed a hyperthread port content side channel attack (aka "PortSmash") (bsc#1113534) - CVE-2018-12120: Fixed that the debugger listens on any interface by default (bsc#1117625) - CVE-2018-12121: Fixed a denial of Service with large HTTP headers (bsc#1117626) - CVE-2018-12122: Fixed the "Slowloris" HTTP Denial of Service (bsc#1117627) - CVE-2018-12116: Fixed HTTP request splitting (bsc#1117630) - CVE-2018-12123: Fixed hostname spoofing in URL parser for javascript protocol (bsc#1117629) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-234=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): nodejs6-6.16.0-18.1 nodejs6-debuginfo-6.16.0-18.1 nodejs6-debugsource-6.16.0-18.1 nodejs6-devel-6.16.0-18.1 npm6-6.16.0-18.1 - openSUSE Leap 42.3 (noarch): nodejs6-docs-6.16.0-18.1 References: https://www.suse.com/security/cve/CVE-2018-0734.html https://www.suse.com/security/cve/CVE-2018-12116.html https://www.suse.com/security/cve/CVE-2018-12120.html https://www.suse.com/security/cve/CVE-2018-12121.html https://www.suse.com/security/cve/CVE-2018-12122.html https://www.suse.com/security/cve/CVE-2018-12123.html https://www.suse.com/security/cve/CVE-2018-5407.html https://bugzilla.suse.com/1113534 https://bugzilla.suse.com/1113652 https://bugzilla.suse.com/1117625 https://bugzilla.suse.com/1117626 https://bugzilla.suse.com/1117627 https://bugzilla.suse.com/1117629 https://bugzilla.suse.com/1117630 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0215-1: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 19 Feb '19

19 Feb '19

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0215-1 Rating: low References: #1124366 Cross-References: CVE-2019-7397 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issues: Security issue fixed: - CVE-2019-7397: Fixed a Memory leak in function WritePDFImage in pdf.c (bsc#1124366) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-215=1 Package List: - openSUSE Leap 15.0 (x86_64): GraphicsMagick-1.3.29-lp150.3.21.1 GraphicsMagick-debuginfo-1.3.29-lp150.3.21.1 GraphicsMagick-debugsource-1.3.29-lp150.3.21.1 GraphicsMagick-devel-1.3.29-lp150.3.21.1 libGraphicsMagick++-Q16-12-1.3.29-lp150.3.21.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.29-lp150.3.21.1 libGraphicsMagick++-devel-1.3.29-lp150.3.21.1 libGraphicsMagick-Q16-3-1.3.29-lp150.3.21.1 libGraphicsMagick-Q16-3-debuginfo-1.3.29-lp150.3.21.1 libGraphicsMagick3-config-1.3.29-lp150.3.21.1 libGraphicsMagickWand-Q16-2-1.3.29-lp150.3.21.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.29-lp150.3.21.1 perl-GraphicsMagick-1.3.29-lp150.3.21.1 perl-GraphicsMagick-debuginfo-1.3.29-lp150.3.21.1 References: https://www.suse.com/security/cve/CVE-2019-7397.html https://bugzilla.suse.com/1124366 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0212-1: moderate: Security update for pspp, spread-sheet-widget
by opensuse-security＠opensuse.org 19 Feb '19

19 Feb '19

openSUSE Security Update: Security update for pspp, spread-sheet-widget ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0212-1 Rating: moderate References: #1120061 Cross-References: CVE-2018-20230 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pspp to version 1.2.0 fixes the following issues: Security issue fixed: - CVE-2018-20230: Fixed a heap-based buffer overflow in read_bytes_internal function that could lead to denial-of-service (bsc#1120061). Other bug fixes and changes: - Add upstream patch to avoid compiling with old Texinfo 4.13. - New experimental command SAVE DATA COLLECTION to save MDD files. - MTIME and YMDHMS variable formats now supported. - Spread sheet rendering now done via spread-sheet-widget. This update introduces a new package called spread-sheet-widget as dependency. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-212=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libspread-sheet-widget0-0.3-2.1 libspread-sheet-widget0-debuginfo-0.3-2.1 spread-sheet-widget-debugsource-0.3-2.1 spread-sheet-widget-devel-0.3-2.1 - openSUSE Leap 42.3 (x86_64): pspp-1.2.0-11.1 pspp-debuginfo-1.2.0-11.1 pspp-debugsource-1.2.0-11.1 pspp-devel-1.2.0-11.1 References: https://www.suse.com/security/cve/CVE-2018-20230.html https://bugzilla.suse.com/1120061 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0214-1: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 19 Feb '19

19 Feb '19

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0214-1 Rating: low References: #1124366 Cross-References: CVE-2019-7397 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issues: Security issue fixed: - CVE-2019-7397: Fixed a Memory leak in WritePDFImage function in pdf.c (bsc#1124366). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-214=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-126.1 GraphicsMagick-debuginfo-1.3.25-126.1 GraphicsMagick-debugsource-1.3.25-126.1 GraphicsMagick-devel-1.3.25-126.1 libGraphicsMagick++-Q16-12-1.3.25-126.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-126.1 libGraphicsMagick++-devel-1.3.25-126.1 libGraphicsMagick-Q16-3-1.3.25-126.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-126.1 libGraphicsMagick3-config-1.3.25-126.1 libGraphicsMagickWand-Q16-2-1.3.25-126.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-126.1 perl-GraphicsMagick-1.3.25-126.1 perl-GraphicsMagick-debuginfo-1.3.25-126.1 References: https://www.suse.com/security/cve/CVE-2019-7397.html https://bugzilla.suse.com/1124366 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0208-1: important: Security update for runc
by opensuse-security＠opensuse.org 19 Feb '19

19 Feb '19

openSUSE Security Update: Security update for runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0208-1 Rating: important References: #1095817 #1118897 #1118898 #1118899 #1121967 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 CVE-2019-5736 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for runc fixes the following issues: Security vulnerablities addressed: - CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967) - CVE-2018-16873: Fix a remote command execution during "go get -u" (boo#1118897) - CVE-2018-16874: Fix a directory traversal in "go get" via curly braces in import paths (boo#1118898) - CVE-2018-16875: Fix a CPU denial of service issue (boo#1118899) Other changes and bug fixes: - Update go requirements to >= go1.10 - Create a symlink in /usr/bin/runc to enable rootless Podman and Buildah. - Make use of %license macro - Remove 'go test' from %check section, as it has only ever caused us problems and hasn't (as far as I remember) ever caught a release-blocking issue. Smoke testing has been far more useful. (boo#1095817) - Upgrade to runc v1.0.0~rc6. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc6 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-208=1 Package List: - openSUSE Leap 15.0 (x86_64): runc-1.0.0~rc6-lp150.2.3.1 runc-debuginfo-1.0.0~rc6-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): runc-test-1.0.0~rc6-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://www.suse.com/security/cve/CVE-2019-5736.html https://bugzilla.suse.com/1095817 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899 https://bugzilla.suse.com/1121967 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0216-1: important: Security update for chromium
by opensuse-security＠opensuse.org 19 Feb '19

19 Feb '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0216-1 Rating: important References: #1123641 #1124936 Cross-References: CVE-2019-5754 CVE-2019-5755 CVE-2019-5756 CVE-2019-5757 CVE-2019-5758 CVE-2019-5759 CVE-2019-5760 CVE-2019-5761 CVE-2019-5762 CVE-2019-5763 CVE-2019-5764 CVE-2019-5765 CVE-2019-5766 CVE-2019-5767 CVE-2019-5768 CVE-2019-5769 CVE-2019-5770 CVE-2019-5771 CVE-2019-5772 CVE-2019-5773 CVE-2019-5774 CVE-2019-5775 CVE-2019-5776 CVE-2019-5777 CVE-2019-5778 CVE-2019-5779 CVE-2019-5780 CVE-2019-5781 CVE-2019-5782 CVE-2019-5784 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 30 vulnerabilities is now available. Description: This update for Chromium to version 72.0.3626.96 fixes the following issues: Security issues fixed (bsc#1123641 and bsc#1124936): - CVE-2019-5784: Inappropriate implementation in V8 - CVE-2019-5754: Inappropriate implementation in QUIC Networking. - CVE-2019-5782: Inappropriate implementation in V8. - CVE-2019-5755: Inappropriate implementation in V8. - CVE-2019-5756: Use after free in PDFium. - CVE-2019-5757: Type Confusion in SVG. - CVE-2019-5758: Use after free in Blink. - CVE-2019-5759: Use after free in HTML select elements. - CVE-2019-5760: Use after free in WebRTC. - CVE-2019-5761: Use after free in SwiftShader. - CVE-2019-5762: Use after free in PDFium. - CVE-2019-5763: Insufficient validation of untrusted input in V8. - CVE-2019-5764: Use after free in WebRTC. - CVE-2019-5765: Insufficient policy enforcement in the browser. - CVE-2019-5766: Insufficient policy enforcement in Canvas. - CVE-2019-5767: Incorrect security UI in WebAPKs. - CVE-2019-5768: Insufficient policy enforcement in DevTools. - CVE-2019-5769: Insufficient validation of untrusted input in Blink. - CVE-2019-5770: Heap buffer overflow in WebGL. - CVE-2019-5771: Heap buffer overflow in SwiftShader. - CVE-2019-5772: Use after free in PDFium. - CVE-2019-5773: Insufficient data validation in IndexedDB. - CVE-2019-5774: Insufficient validation of untrusted input in SafeBrowsing. - CVE-2019-5775: Insufficient policy enforcement in Omnibox. - CVE-2019-5776: Insufficient policy enforcement in Omnibox. - CVE-2019-5777: Insufficient policy enforcement in Omnibox. - CVE-2019-5778: Insufficient policy enforcement in Extensions. - CVE-2019-5779: Insufficient policy enforcement in ServiceWorker. - CVE-2019-5780: Insufficient policy enforcement. - CVE-2019-5781: Insufficient policy enforcement in Omnibox. For a full list of changes refer to https://chromereleases.googleblog.com/2019/02/stable-channel-update-for-des ktop.html This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-216=1 Package List: - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-72.0.3626.96-bp150.2.32.1 chromium-72.0.3626.96-bp150.2.32.1 References: https://www.suse.com/security/cve/CVE-2019-5754.html https://www.suse.com/security/cve/CVE-2019-5755.html https://www.suse.com/security/cve/CVE-2019-5756.html https://www.suse.com/security/cve/CVE-2019-5757.html https://www.suse.com/security/cve/CVE-2019-5758.html https://www.suse.com/security/cve/CVE-2019-5759.html https://www.suse.com/security/cve/CVE-2019-5760.html https://www.suse.com/security/cve/CVE-2019-5761.html https://www.suse.com/security/cve/CVE-2019-5762.html https://www.suse.com/security/cve/CVE-2019-5763.html https://www.suse.com/security/cve/CVE-2019-5764.html https://www.suse.com/security/cve/CVE-2019-5765.html https://www.suse.com/security/cve/CVE-2019-5766.html https://www.suse.com/security/cve/CVE-2019-5767.html https://www.suse.com/security/cve/CVE-2019-5768.html https://www.suse.com/security/cve/CVE-2019-5769.html https://www.suse.com/security/cve/CVE-2019-5770.html https://www.suse.com/security/cve/CVE-2019-5771.html https://www.suse.com/security/cve/CVE-2019-5772.html https://www.suse.com/security/cve/CVE-2019-5773.html https://www.suse.com/security/cve/CVE-2019-5774.html https://www.suse.com/security/cve/CVE-2019-5775.html https://www.suse.com/security/cve/CVE-2019-5776.html https://www.suse.com/security/cve/CVE-2019-5777.html https://www.suse.com/security/cve/CVE-2019-5778.html https://www.suse.com/security/cve/CVE-2019-5779.html https://www.suse.com/security/cve/CVE-2019-5780.html https://www.suse.com/security/cve/CVE-2019-5781.html https://www.suse.com/security/cve/CVE-2019-5782.html https://www.suse.com/security/cve/CVE-2019-5784.html https://bugzilla.suse.com/1123641 https://bugzilla.suse.com/1124936 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0207-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 19 Feb '19

19 Feb '19

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0207-1 Rating: moderate References: #1118832 #1123354 #1123522 Cross-References: CVE-2018-19935 CVE-2019-6977 CVE-2019-6978 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for php7 fixes the following issues: Security issue fixed: - CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function (bsc#1123354). - CVE-2019-6978: Fixed a double free in the gdImage*Ptr() functions (bsc#1123522). - CVE-2018-19935: Fixed a Denial of Service in php_imap.c which could be triggered via an empty string in the message argument to imap_mail (bsc#1118832). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-207=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php7-7.0.7-55.1 apache2-mod_php7-debuginfo-7.0.7-55.1 php7-7.0.7-55.1 php7-bcmath-7.0.7-55.1 php7-bcmath-debuginfo-7.0.7-55.1 php7-bz2-7.0.7-55.1 php7-bz2-debuginfo-7.0.7-55.1 php7-calendar-7.0.7-55.1 php7-calendar-debuginfo-7.0.7-55.1 php7-ctype-7.0.7-55.1 php7-ctype-debuginfo-7.0.7-55.1 php7-curl-7.0.7-55.1 php7-curl-debuginfo-7.0.7-55.1 php7-dba-7.0.7-55.1 php7-dba-debuginfo-7.0.7-55.1 php7-debuginfo-7.0.7-55.1 php7-debugsource-7.0.7-55.1 php7-devel-7.0.7-55.1 php7-dom-7.0.7-55.1 php7-dom-debuginfo-7.0.7-55.1 php7-enchant-7.0.7-55.1 php7-enchant-debuginfo-7.0.7-55.1 php7-exif-7.0.7-55.1 php7-exif-debuginfo-7.0.7-55.1 php7-fastcgi-7.0.7-55.1 php7-fastcgi-debuginfo-7.0.7-55.1 php7-fileinfo-7.0.7-55.1 php7-fileinfo-debuginfo-7.0.7-55.1 php7-firebird-7.0.7-55.1 php7-firebird-debuginfo-7.0.7-55.1 php7-fpm-7.0.7-55.1 php7-fpm-debuginfo-7.0.7-55.1 php7-ftp-7.0.7-55.1 php7-ftp-debuginfo-7.0.7-55.1 php7-gd-7.0.7-55.1 php7-gd-debuginfo-7.0.7-55.1 php7-gettext-7.0.7-55.1 php7-gettext-debuginfo-7.0.7-55.1 php7-gmp-7.0.7-55.1 php7-gmp-debuginfo-7.0.7-55.1 php7-iconv-7.0.7-55.1 php7-iconv-debuginfo-7.0.7-55.1 php7-imap-7.0.7-55.1 php7-imap-debuginfo-7.0.7-55.1 php7-intl-7.0.7-55.1 php7-intl-debuginfo-7.0.7-55.1 php7-json-7.0.7-55.1 php7-json-debuginfo-7.0.7-55.1 php7-ldap-7.0.7-55.1 php7-ldap-debuginfo-7.0.7-55.1 php7-mbstring-7.0.7-55.1 php7-mbstring-debuginfo-7.0.7-55.1 php7-mcrypt-7.0.7-55.1 php7-mcrypt-debuginfo-7.0.7-55.1 php7-mysql-7.0.7-55.1 php7-mysql-debuginfo-7.0.7-55.1 php7-odbc-7.0.7-55.1 php7-odbc-debuginfo-7.0.7-55.1 php7-opcache-7.0.7-55.1 php7-opcache-debuginfo-7.0.7-55.1 php7-openssl-7.0.7-55.1 php7-openssl-debuginfo-7.0.7-55.1 php7-pcntl-7.0.7-55.1 php7-pcntl-debuginfo-7.0.7-55.1 php7-pdo-7.0.7-55.1 php7-pdo-debuginfo-7.0.7-55.1 php7-pgsql-7.0.7-55.1 php7-pgsql-debuginfo-7.0.7-55.1 php7-phar-7.0.7-55.1 php7-phar-debuginfo-7.0.7-55.1 php7-posix-7.0.7-55.1 php7-posix-debuginfo-7.0.7-55.1 php7-pspell-7.0.7-55.1 php7-pspell-debuginfo-7.0.7-55.1 php7-readline-7.0.7-55.1 php7-readline-debuginfo-7.0.7-55.1 php7-shmop-7.0.7-55.1 php7-shmop-debuginfo-7.0.7-55.1 php7-snmp-7.0.7-55.1 php7-snmp-debuginfo-7.0.7-55.1 php7-soap-7.0.7-55.1 php7-soap-debuginfo-7.0.7-55.1 php7-sockets-7.0.7-55.1 php7-sockets-debuginfo-7.0.7-55.1 php7-sqlite-7.0.7-55.1 php7-sqlite-debuginfo-7.0.7-55.1 php7-sysvmsg-7.0.7-55.1 php7-sysvmsg-debuginfo-7.0.7-55.1 php7-sysvsem-7.0.7-55.1 php7-sysvsem-debuginfo-7.0.7-55.1 php7-sysvshm-7.0.7-55.1 php7-sysvshm-debuginfo-7.0.7-55.1 php7-tidy-7.0.7-55.1 php7-tidy-debuginfo-7.0.7-55.1 php7-tokenizer-7.0.7-55.1 php7-tokenizer-debuginfo-7.0.7-55.1 php7-wddx-7.0.7-55.1 php7-wddx-debuginfo-7.0.7-55.1 php7-xmlreader-7.0.7-55.1 php7-xmlreader-debuginfo-7.0.7-55.1 php7-xmlrpc-7.0.7-55.1 php7-xmlrpc-debuginfo-7.0.7-55.1 php7-xmlwriter-7.0.7-55.1 php7-xmlwriter-debuginfo-7.0.7-55.1 php7-xsl-7.0.7-55.1 php7-xsl-debuginfo-7.0.7-55.1 php7-zip-7.0.7-55.1 php7-zip-debuginfo-7.0.7-55.1 php7-zlib-7.0.7-55.1 php7-zlib-debuginfo-7.0.7-55.1 - openSUSE Leap 42.3 (noarch): php7-pear-7.0.7-55.1 php7-pear-Archive_Tar-7.0.7-55.1 References: https://www.suse.com/security/cve/CVE-2018-19935.html https://www.suse.com/security/cve/CVE-2019-6977.html https://www.suse.com/security/cve/CVE-2019-6978.html https://bugzilla.suse.com/1118832 https://bugzilla.suse.com/1123354 https://bugzilla.suse.com/1123522 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0205-1: important: Security update for chromium
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0205-1 Rating: important References: #1123641 #1124936 Cross-References: CVE-2019-5754 CVE-2019-5755 CVE-2019-5756 CVE-2019-5757 CVE-2019-5758 CVE-2019-5759 CVE-2019-5760 CVE-2019-5761 CVE-2019-5762 CVE-2019-5763 CVE-2019-5764 CVE-2019-5765 CVE-2019-5766 CVE-2019-5767 CVE-2019-5768 CVE-2019-5769 CVE-2019-5770 CVE-2019-5771 CVE-2019-5772 CVE-2019-5773 CVE-2019-5774 CVE-2019-5775 CVE-2019-5776 CVE-2019-5777 CVE-2019-5778 CVE-2019-5779 CVE-2019-5780 CVE-2019-5781 CVE-2019-5782 CVE-2019-5784 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 30 vulnerabilities is now available. Description: This update for Chromium to version 72.0.3626.96 fixes the following issues: Security issues fixed (bsc#1123641 and bsc#1124936): - CVE-2019-5784: Inappropriate implementation in V8 - CVE-2019-5754: Inappropriate implementation in QUIC Networking. - CVE-2019-5782: Inappropriate implementation in V8. - CVE-2019-5755: Inappropriate implementation in V8. - CVE-2019-5756: Use after free in PDFium. - CVE-2019-5757: Type Confusion in SVG. - CVE-2019-5758: Use after free in Blink. - CVE-2019-5759: Use after free in HTML select elements. - CVE-2019-5760: Use after free in WebRTC. - CVE-2019-5761: Use after free in SwiftShader. - CVE-2019-5762: Use after free in PDFium. - CVE-2019-5763: Insufficient validation of untrusted input in V8. - CVE-2019-5764: Use after free in WebRTC. - CVE-2019-5765: Insufficient policy enforcement in the browser. - CVE-2019-5766: Insufficient policy enforcement in Canvas. - CVE-2019-5767: Incorrect security UI in WebAPKs. - CVE-2019-5768: Insufficient policy enforcement in DevTools. - CVE-2019-5769: Insufficient validation of untrusted input in Blink. - CVE-2019-5770: Heap buffer overflow in WebGL. - CVE-2019-5771: Heap buffer overflow in SwiftShader. - CVE-2019-5772: Use after free in PDFium. - CVE-2019-5773: Insufficient data validation in IndexedDB. - CVE-2019-5774: Insufficient validation of untrusted input in SafeBrowsing. - CVE-2019-5775: Insufficient policy enforcement in Omnibox. - CVE-2019-5776: Insufficient policy enforcement in Omnibox. - CVE-2019-5777: Insufficient policy enforcement in Omnibox. - CVE-2019-5778: Insufficient policy enforcement in Extensions. - CVE-2019-5779: Insufficient policy enforcement in ServiceWorker. - CVE-2019-5780: Insufficient policy enforcement. - CVE-2019-5781: Insufficient policy enforcement in Omnibox. For a full list of changes refer to https://chromereleases.googleblog.com/2019/02/stable-channel-update-for-des ktop.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-205=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-72.0.3626.96-197.1 chromedriver-debuginfo-72.0.3626.96-197.1 chromium-72.0.3626.96-197.1 chromium-debuginfo-72.0.3626.96-197.1 chromium-debugsource-72.0.3626.96-197.1 References: https://www.suse.com/security/cve/CVE-2019-5754.html https://www.suse.com/security/cve/CVE-2019-5755.html https://www.suse.com/security/cve/CVE-2019-5756.html https://www.suse.com/security/cve/CVE-2019-5757.html https://www.suse.com/security/cve/CVE-2019-5758.html https://www.suse.com/security/cve/CVE-2019-5759.html https://www.suse.com/security/cve/CVE-2019-5760.html https://www.suse.com/security/cve/CVE-2019-5761.html https://www.suse.com/security/cve/CVE-2019-5762.html https://www.suse.com/security/cve/CVE-2019-5763.html https://www.suse.com/security/cve/CVE-2019-5764.html https://www.suse.com/security/cve/CVE-2019-5765.html https://www.suse.com/security/cve/CVE-2019-5766.html https://www.suse.com/security/cve/CVE-2019-5767.html https://www.suse.com/security/cve/CVE-2019-5768.html https://www.suse.com/security/cve/CVE-2019-5769.html https://www.suse.com/security/cve/CVE-2019-5770.html https://www.suse.com/security/cve/CVE-2019-5771.html https://www.suse.com/security/cve/CVE-2019-5772.html https://www.suse.com/security/cve/CVE-2019-5773.html https://www.suse.com/security/cve/CVE-2019-5774.html https://www.suse.com/security/cve/CVE-2019-5775.html https://www.suse.com/security/cve/CVE-2019-5776.html https://www.suse.com/security/cve/CVE-2019-5777.html https://www.suse.com/security/cve/CVE-2019-5778.html https://www.suse.com/security/cve/CVE-2019-5779.html https://www.suse.com/security/cve/CVE-2019-5780.html https://www.suse.com/security/cve/CVE-2019-5781.html https://www.suse.com/security/cve/CVE-2019-5782.html https://www.suse.com/security/cve/CVE-2019-5784.html https://bugzilla.suse.com/1123641 https://bugzilla.suse.com/1124936 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0201-1: important: Security update for docker-runc
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for docker-runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0201-1 Rating: important References: #1121967 Cross-References: CVE-2019-5736 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for docker-runc fixes the following issues: Security issue fixed: - CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-201=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): docker-runc-1.0.0rc5+gitr3562_69663f0bd4b6-8.1 docker-runc-debuginfo-1.0.0rc5+gitr3562_69663f0bd4b6-8.1 docker-runc-debugsource-1.0.0rc5+gitr3562_69663f0bd4b6-8.1 docker-runc-kubic-1.0.0rc5+gitr3562_69663f0bd4b6-8.1 docker-runc-kubic-debuginfo-1.0.0rc5+gitr3562_69663f0bd4b6-8.1 docker-runc-kubic-debugsource-1.0.0rc5+gitr3562_69663f0bd4b6-8.1 - openSUSE Leap 42.3 (noarch): docker-runc-kubic-test-1.0.0rc5+gitr3562_69663f0bd4b6-8.1 docker-runc-test-1.0.0rc5+gitr3562_69663f0bd4b6-8.1 References: https://www.suse.com/security/cve/CVE-2019-5736.html https://bugzilla.suse.com/1121967 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0204-1: important: Security update for chromium
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0204-1 Rating: important References: #1123641 #1124936 Cross-References: CVE-2019-5754 CVE-2019-5755 CVE-2019-5756 CVE-2019-5757 CVE-2019-5758 CVE-2019-5759 CVE-2019-5760 CVE-2019-5761 CVE-2019-5762 CVE-2019-5763 CVE-2019-5764 CVE-2019-5765 CVE-2019-5766 CVE-2019-5767 CVE-2019-5768 CVE-2019-5769 CVE-2019-5770 CVE-2019-5771 CVE-2019-5772 CVE-2019-5773 CVE-2019-5774 CVE-2019-5775 CVE-2019-5776 CVE-2019-5777 CVE-2019-5778 CVE-2019-5779 CVE-2019-5780 CVE-2019-5781 CVE-2019-5782 CVE-2019-5784 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 30 vulnerabilities is now available. Description: This update for Chromium to version 72.0.3626.96 fixes the following issues: Security issues fixed (bsc#1123641 and bsc#1124936): - CVE-2019-5784: Inappropriate implementation in V8 - CVE-2019-5754: Inappropriate implementation in QUIC Networking. - CVE-2019-5782: Inappropriate implementation in V8. - CVE-2019-5755: Inappropriate implementation in V8. - CVE-2019-5756: Use after free in PDFium. - CVE-2019-5757: Type Confusion in SVG. - CVE-2019-5758: Use after free in Blink. - CVE-2019-5759: Use after free in HTML select elements. - CVE-2019-5760: Use after free in WebRTC. - CVE-2019-5761: Use after free in SwiftShader. - CVE-2019-5762: Use after free in PDFium. - CVE-2019-5763: Insufficient validation of untrusted input in V8. - CVE-2019-5764: Use after free in WebRTC. - CVE-2019-5765: Insufficient policy enforcement in the browser. - CVE-2019-5766: Insufficient policy enforcement in Canvas. - CVE-2019-5767: Incorrect security UI in WebAPKs. - CVE-2019-5768: Insufficient policy enforcement in DevTools. - CVE-2019-5769: Insufficient validation of untrusted input in Blink. - CVE-2019-5770: Heap buffer overflow in WebGL. - CVE-2019-5771: Heap buffer overflow in SwiftShader. - CVE-2019-5772: Use after free in PDFium. - CVE-2019-5773: Insufficient data validation in IndexedDB. - CVE-2019-5774: Insufficient validation of untrusted input in SafeBrowsing. - CVE-2019-5775: Insufficient policy enforcement in Omnibox. - CVE-2019-5776: Insufficient policy enforcement in Omnibox. - CVE-2019-5777: Insufficient policy enforcement in Omnibox. - CVE-2019-5778: Insufficient policy enforcement in Extensions. - CVE-2019-5779: Insufficient policy enforcement in ServiceWorker. - CVE-2019-5780: Insufficient policy enforcement. - CVE-2019-5781: Insufficient policy enforcement in Omnibox. For a full list of changes refer to https://chromereleases.googleblog.com/2019/02/stable-channel-update-for-des ktop.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-204=1 Package List: - openSUSE Leap 15.0 (x86_64): chromedriver-72.0.3626.96-lp150.2.41.1 chromedriver-debuginfo-72.0.3626.96-lp150.2.41.1 chromium-72.0.3626.96-lp150.2.41.1 chromium-debuginfo-72.0.3626.96-lp150.2.41.1 chromium-debugsource-72.0.3626.96-lp150.2.41.1 References: https://www.suse.com/security/cve/CVE-2019-5754.html https://www.suse.com/security/cve/CVE-2019-5755.html https://www.suse.com/security/cve/CVE-2019-5756.html https://www.suse.com/security/cve/CVE-2019-5757.html https://www.suse.com/security/cve/CVE-2019-5758.html https://www.suse.com/security/cve/CVE-2019-5759.html https://www.suse.com/security/cve/CVE-2019-5760.html https://www.suse.com/security/cve/CVE-2019-5761.html https://www.suse.com/security/cve/CVE-2019-5762.html https://www.suse.com/security/cve/CVE-2019-5763.html https://www.suse.com/security/cve/CVE-2019-5764.html https://www.suse.com/security/cve/CVE-2019-5765.html https://www.suse.com/security/cve/CVE-2019-5766.html https://www.suse.com/security/cve/CVE-2019-5767.html https://www.suse.com/security/cve/CVE-2019-5768.html https://www.suse.com/security/cve/CVE-2019-5769.html https://www.suse.com/security/cve/CVE-2019-5770.html https://www.suse.com/security/cve/CVE-2019-5771.html https://www.suse.com/security/cve/CVE-2019-5772.html https://www.suse.com/security/cve/CVE-2019-5773.html https://www.suse.com/security/cve/CVE-2019-5774.html https://www.suse.com/security/cve/CVE-2019-5775.html https://www.suse.com/security/cve/CVE-2019-5776.html https://www.suse.com/security/cve/CVE-2019-5777.html https://www.suse.com/security/cve/CVE-2019-5778.html https://www.suse.com/security/cve/CVE-2019-5779.html https://www.suse.com/security/cve/CVE-2019-5780.html https://www.suse.com/security/cve/CVE-2019-5781.html https://www.suse.com/security/cve/CVE-2019-5782.html https://www.suse.com/security/cve/CVE-2019-5784.html https://bugzilla.suse.com/1123641 https://bugzilla.suse.com/1124936 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0203-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0203-1 Rating: important References: #1046306 #1050252 #1051510 #1054610 #1055121 #1056658 #1056662 #1084216 #1086301 #1086313 #1086314 #1086323 #1087082 #1087092 #1098382 #1098425 #1104353 #1106105 #1106434 #1106811 #1108870 #1109695 #1110705 #1111666 #1113712 #1113722 #1114279 #1117155 #1118338 #1118505 #1119086 #1119766 #1120318 #1120758 #1120854 #1120902 #1120954 #1120955 #1121599 #1121726 #1121973 #1122019 #1122324 #1122554 #1122662 #1122779 #1122885 #1122927 #1122944 #1122971 #1123061 #1123317 #1123348 #1123357 #1123538 #1123697 #1123933 #1124204 #1124579 #1124589 #1124728 #1124732 #1124735 #1124969 #1124985 #1125109 #802154 Cross-References: CVE-2018-20669 CVE-2019-3459 CVE-2019-3460 CVE-2019-6974 CVE-2019-7221 CVE-2019-7222 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has 61 fixes is now available. Description: The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2019-3459,CVE-2019-3460: Two information leaks in the bluetooth stack were fixed. (bnc#1120758). - CVE-2019-7221: A use-after-free in the KVM nVMX hrtimer was fixed. (bnc#1124732). - CVE-2019-7222: A information leak in exception handling in KVM could be used to expose host memory to guests. (bnc#1124735). - CVE-2019-6974: A use-after-free in the KVM device control API was fixed. (bnc#1124728). - CVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915 driver were fixed which might have lead to information leaks. (bnc#1122971). The following non-security bugs were fixed: - 6lowpan: iphc: reset mac_header after decompress to fix panic (bsc#1051510). - 9p: clear dangling pointers in p9stat_free (bsc#1051510). - 9p locks: fix glock.client_id leak in do_lock (bsc#1051510). - 9p/net: put a lower bound on msize (bsc#1051510). - acpi/nfit: Block function zero DSMs (bsc#1051510). - acpi, nfit: Fix Address Range Scrub completion tracking (bsc#1124969). - acpi/nfit: Fix command-supported detection (bsc#1051510). - acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id() (bsc#1122662). - acpi/nfit: Fix user-initiated ARS to be "ARS-long" rather than "ARS-short" (bsc#1124969). - ACPI: power: Skip duplicate power resource references in _PRx (bsc#1051510). - Add delay-init quirk for Corsair K70 RGB keyboards (bsc#1087092). - af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers (bsc#1051510). - alsa: bebob: fix model-id of unit for Apogee Ensemble (bsc#1051510). - alsa: compress: Fix stop handling on compressed capture streams (bsc#1051510). - alsa: hda - Add mute LED support for HP ProBook 470 G5 (bsc#1051510). - alsa: hda/ca0132 - Fix build error without CONFIG_PCI (bsc#1051510). - alsa: hda/realtek - Fixed hp_pin no value (bsc#1051510). - alsa: hda/realtek - Fix lose hp_pins for disable auto mute (bsc#1051510). - alsa: hda/realtek - Use a common helper for hp pin reference (bsc#1051510). - alsa: hda - Serialize codec registrations (bsc#1122944). - alsa: hda - Use standard device registration for beep (bsc#1122944). - alsa: oxfw: add support for APOGEE duet FireWire (bsc#1051510). - alsa: usb-audio: Add Opus #3 to quirks for native DSD support (bsc#1051510). - alsa: usb-audio: Add support for new T+A USB DAC (bsc#1051510). - amd-xgbe: Fix mdio access for non-zero ports and clause 45 PHYs (bsc#1122927). - arm: 8802/1: Call syscall_trace_exit even when system call skipped (bsc#1051510). - arm: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling (bsc#1051510). - arm: 8815/1: V7M: align v7m_dma_inv_range() with v7 counterpart (bsc#1051510). - arm/arm64: kvm:vgic: Force VM halt when changing the active state of GICv3 PPIs/SGIs (bsc#1051510). - arm: cns3xxx: Fix writing to wrong PCI config registers after alignment (bsc#1051510). - arm: cns3xxx: Use actual size reads for PCIe (bsc#1051510). - arm: imx: update the cpu power up timing setting on i.mx6sx (bsc#1051510). - arm: kvm:Fix VTTBR_BADDR_MASK BUG_ON off-by-one (bsc#1051510). - arm: mmp/mmp2: fix cpu_is_mmp2() on mmp2-dt (bsc#1051510). - arm: OMAP1: ams-delta: Fix possible use of uninitialized field (bsc#1051510). - arm: OMAP2+: prm44xx: Fix section annotation on omap44xx_prm_enable_io_wakeup (bsc#1051510). - ASoC: dma-sh7760: cleanup a debug printk (bsc#1051510). - ASoC: rt5514-spi: Fix potential NULL pointer dereference (bsc#1051510). - ax25: fix a use-after-free in ax25_fillin_cb() (networking-stable-19_01_04). - be2net: do not flip hw_features when VXLANs are added/deleted (bsc#1050252). - blkdev: avoid migration stalls for blkdev pages (bsc#1084216). - blk-mq: fix kernel oops in blk_mq_tag_idle() (bsc#1051510). - block: break discard submissions into the user defined size (git-fixes). - block: cleanup __blkdev_issue_discard() (git-fixes). - block: do not deal with discard limit in blkdev_issue_discard() (git-fixes). - block: fix 32 bit overflow in __blkdev_issue_discard() (git-fixes). - block: fix infinite loop if the device loses discard capability (git-fixes). - block: make sure discard bio is aligned with logical block size (git-fixes). - block: make sure writesame bio is aligned with logical block size (git-fixes). - block/swim3: Fix -EBUSY error when re-opening device after unmount (git-fixes). - bnx2x: Assign unique DMAE channel number for FW DMAE transactions (bsc#1086323). - bnx2x: Clear fip MAC when fcoe offload support is disabled (bsc#1086323). - bnx2x: Fix NULL pointer dereference in bnx2x_del_all_vlans() on some hw (bsc#1086323). - bnx2x: Remove configured vlans as part of unload sequence (bsc#1086323). - bnx2x: Send update-svid ramrod with retry/poll flags enabled (bsc#1086323). - bonding: update nest level on unlink (git-fixes). - bsg: allocate sense buffer if requested (bsc#1106811). - btrfs: qgroup: Fix root item corruption when multiple same source snapshots are created with quota enabled (bsc#1122324). - can: bcm: check timer values before ktime conversion (bsc#1051510). - can: dev: __can_get_echo_skb(): fix bogous check for non-existing skb by removing it (bsc#1051510). - can: gw: ensure DLC boundaries after CAN frame modification (bsc#1051510). - cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader (bsc#1051510). - char/mwave: fix potential Spectre v1 vulnerability (bsc#1051510). - checkstack.pl: fix for aarch64 (bsc#1051510). - cifs: add missing debug entries for kconfig options (bsc#1051510). - cifs: add missing support for ACLs in SMB 3.11 (bsc#1051510). - cifs: add sha512 secmech (bsc#1051510). - cifs: Add support for reading attributes on SMB2+ (bsc#1051510). - cifs: Add support for writing attributes on SMB2+ (bsc#1051510). - cifs: do not log STATUS_NOT_FOUND errors for DFS (bsc#1051510). - cifs: Do not modify mid entry after submitting I/O in cifs_call_async (bsc#1051510). - cifs: Fix error mapping for SMB2_LOCK command which caused OFD lock problem (bsc#1051510). - cifs: Fix memory leak in smb2_set_ea() (bsc#1051510). - cifs: fix return value for cifs_listxattr (bsc#1051510). - cifs: Fix separator when building path from dentry (bsc#1051510). - cifs: fix set info (bsc#1051510). - cifs: fix sha512 check in cifs_crypto_secmech_release (bsc#1051510). - cifs: fix wrapping bugs in num_entries() (bsc#1051510). - cifs: For SMB2 security informaion query, check for minimum sized security descriptor instead of sizeof FileAllInformation class (bsc#1051510). - cifs: hide unused functions (bsc#1051510). - cifs: hide unused functions (bsc#1051510). - cifs: implement v3.11 preauth integrity (bsc#1051510). - cifs: make 'nodfs' mount opt a superblock flag (bsc#1051510). - cifs: prevent integer overflow in nxt_dir_entry() (bsc#1051510). - cifs: prototype declaration and definition for smb 2 - 3 and cifsacl mount options (bsc#1051510). - cifs: prototype declaration and definition to set acl for smb 2 - 3 and cifsacl mount options (bsc#1051510). - cifs: refactor crypto shash/sdesc allocation&free (bsc#1051510). - cifs: smb2ops: Fix listxattr() when there are no EAs (bsc#1051510). - cifs: Use smb 2 - 3 and cifsacl mount options getacl functions (bsc#1051510). - cifs: Use smb 2 - 3 and cifsacl mount options setacl function (bsc#1051510). - cifs: Use ULL suffix for 64-bit constant (bsc#1051510). - clk: imx6q: reset exclusive gates on init (bsc#1051510). - clk: rockchip: fix typo in rk3188 spdif_frac parent (bsc#1051510). - clk: sunxi-ng: enable so-said LDOs for A64 SoC's pll-mipi clock (bsc#1051510). - clk: sunxi-ng: h3/h5: Fix CSI_MCLK parent (bsc#1051510). - cpufreq: imx6q: add return value check for voltage scale (bsc#1051510). - Cramfs: fix abad comparison when wrap-arounds occur (bsc#1051510). - crypto: authencesn - Avoid twice completion call in decrypt path (bsc#1051510). - crypto: authenc - fix parsing key with misaligned rta_len (bsc#1051510). - crypto: bcm - convert to use crypto_authenc_extractkeys() (bsc#1051510). - crypto: caam - fix zero-length buffer DMA mapping (bsc#1051510). - crypto: user - support incremental algorithm dumps (bsc#1120902). - dlm: fixed memory leaks after failed ls_remove_names allocation (bsc#1051510). - dlm: lost put_lkb on error path in receive_convert() and receive_unlock() (bsc#1051510). - dlm: memory leaks on error path in dlm_user_request() (bsc#1051510). - dlm: possible memory leak on error path in create_lkb() (bsc#1051510). - dmaengine: at_hdmac: fix memory leak in at_dma_xlate() (bsc#1051510). - dmaengine: at_hdmac: fix module unloading (bsc#1051510). - dmaengine: dma-jz4780: Return error if not probed from DT (bsc#1051510). - dmaengine: dw: Fix FIFO size for Intel Merrifield (bsc#1051510). - dmaengine: xilinx_dma: Remove __aligned attribute on zynqmp_dma_desc_ll (bsc#1051510). - dm cache metadata: verify cache has blocks in blocks_are_clean_separate_dirty() (git-fixes). - dm: call blk_queue_split() to impose device limits on bios (git-fixes). - dm: do not allow readahead to limit IO size (git-fixes). - dm thin: send event about thin-pool state change _after_ making it (git-fixes). - dm zoned: Fix target BIO completion handling (git-fixes). - Do not log expected error on DFS referral request (bsc#1051510). - driver core: Move async_synchronize_full call (bsc#1051510). - drivers: core: Remove glue dirs from sysfs earlier (bsc#1051510). - drivers/misc/sgi-gru: fix Spectre v1 vulnerability (bsc#1051510). - drivers/net/ethernet/qlogic/qed/qed_rdma.h: fix typo (bsc#1086314 bsc#1086313 bsc#1086301 ). - drivers/sbus/char: add of_node_put() (bsc#1051510). - drivers/tty: add missing of_node_put() (bsc#1051510). - drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock (bsc#1113722) - drm/fb-helper: Partially bring back workaround for bugs of SDL 1.2 (bsc#1113722) - drm/i915/gvt: Fix mmap range check (bsc#1120902) - drm/nouveau/tmr: detect stalled gpu timer and break out of waits (bsc#1123538). - drm/vmwgfx: Fix setting of dma masks (bsc#1120902) - drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user (bsc#1120902) - e1000e: allow non-monotonic SYSTIM readings (bsc#1051510). - exportfs: do not read dentry after free (bsc#1051510). - ext4: Fix crash during online resizing (bsc#1122779). - fanotify: fix handling of events on child sub-directory (bsc#1122019). - fat: validate ->i_start before using (bsc#1051510). - fix smb3-encryption breakage when CONFIG_DEBUG_SG=y (bsc#1051510). - fork: do not copy inconsistent signal handler state to child (bsc#1051510). - fork: record start_time late (git-fixes). - fork: unconditionally clear stack on fork (git-fixes). - fs/cifs: require sha512 (bsc#1051510). - gpio: altera-a10sr: Set proper output level for direction_output (bsc#1051510). - gpio: pcf857x: Fix interrupts on multiple instances (bsc#1051510). - gpio: pl061: handle failed allocations (bsc#1051510). - gpio: pl061: Move irq_chip definition inside struct pl061 (bsc#1051510). - gpio: vf610: Mask all GPIO interrupts (bsc#1051510). - gro_cell: add napi_disable in gro_cells_destroy (networking-stable-19_01_04). - hfs: do not free node before using (bsc#1051510). - hfsplus: do not free node before using (bsc#1051510). - hfsplus: prevent btree data loss on root split (bsc#1051510). - hfs: prevent btree data loss on root split (bsc#1051510). - i2c: dev: prevent adapter retries and timeout being set as minus value (bsc#1051510). - i40e: fix mac filter delete when setting mac address (bsc#1056658 bsc#1056662). - i40e: report correct statistics when XDP is enabled (bsc#1056658 bsc#1056662). - i40e: restore NETIF_F_GSO_IPXIP to netdev features (bsc#1056658 bsc#1056662). - ibmveth: Do not process frames after calling napi_reschedule (bcs#1123357). - ibmveth: fix DMA unmap error in ibmveth_xmit_start error path (networking-stable-19_01_04). - ibmvnic: Add ethtool private flag for driver-defined queue limits (bsc#1121726). - ibmvnic: Increase maximum queue size limit (bsc#1121726). - ibmvnic: Introduce driver limits for ring sizes (bsc#1121726). - ide: pmac: add of_node_put() (bsc#1051510). - ieee802154: lowpan_header_create check must check daddr (networking-stable-19_01_04). - input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G (bsc#1051510). - input: omap-keypad - fix idle configuration to not block SoC idle states (bsc#1051510). - input: raspberrypi-ts - fix link error (git-fixes). - input: restore EV_ABS ABS_RESERVED (bsc#1051510). - input: synaptics - enable RMI on ThinkPad T560 (bsc#1051510). - input: synaptics - enable SMBus for HP EliteBook 840 G4 (bsc#1051510). - input: xpad - add support for SteelSeries Stratus Duo (bsc#1111666). - iommu/amd: Call free_iova_fast with pfn in map_sg (bsc#1106105). - iommu/amd: Fix IOMMU page flush when detach device from a domain (bsc#1106105). - iommu/amd: Unmap all mapped pages in error path of map_sg (bsc#1106105). - iommu/vt-d: Fix memory leak in intel_iommu_put_resv_regions() (bsc#1106105). - ip6mr: Fix potential Spectre v1 vulnerability (networking-stable-19_01_04). - ipmi:pci: Blacklist a Realtek "IPMI" device (git-fixes). - ipmi:ssif: Fix handling of multi-part return messages (bsc#1051510). - ip: on queued skb use skb_header_pointer instead of pskb_may_pull (git-fixes). - ipv4: Fix potential Spectre v1 vulnerability (networking-stable-19_01_04). - ipv4: ipv6: netfilter: Adjust the frag mem limit when truesize changes (networking-stable-18_12_12). - ipv6: Check available headroom in ip6_xmit() even without options (networking-stable-18_12_12). - ipv6: explicitly initialize udp6_addr in udp_sock_create6() (networking-stable-19_01_04). - ipv6: sr: properly initialize flowi6 prior passing to ip6_route_output (networking-stable-18_12_12). - ipv6: tunnels: fix two use-after-free (networking-stable-19_01_04). - ip: validate header length on virtual device xmit (networking-stable-19_01_04). - iscsi target: fix session creation failure handling (bsc#1051510). - isdn: fix kernel-infoleak in capi_unlocked_ioctl (bsc#1051510). - iwlwifi: fix non_shared_ant for 22000 devices (bsc#1119086). - iwlwifi: fix wrong WGDS_WIFI_DATA_SIZE (bsc#1119086). - iwlwifi: mvm: do not send GEO_TX_POWER_LIMIT to old firmwares (bsc#1119086). - jffs2: Fix use of uninitialized delayed_work, lockdep breakage (bsc#1051510). - kABI: fix xhci kABI stability (bsc#1119086). - kABI: protect struct sctp_association (kabi). - kABI workaround for deleted snd_hda_register_beep_device() (bsc#1122944). - kABI workaround for snd_hda_bus.bus_probing addition (bsc#1122944). - kdb: use memmove instead of overlapping memcpy (bsc#1120954). - kernel/exit.c: release ptraced tasks before zap_pid_ns_processes (git-fixes). - kvm: arm/arm64: Properly protect VGIC locks from IRQs (bsc#1117155). - kvm: arm/arm64: VGIC/ITS: Promote irq_lock() in update_affinity (bsc#1117155). - kvm: arm/arm64: VGIC/ITS: protect kvm_read_guest() calls with SRCU lock (bsc#1117155). - kvm: arm/arm64: VGIC/ITS save/restore: protect kvm_read_guest() calls (bsc#1117155). - kvm: PPC: Book3S PR: Set hflag to indicate that POWER9 supports 1T segments (bsc#1124589). - kvm: sev: Fail KVM_SEV_INIT if already initialized (bsc#1114279). - kvm: x86: fix L1TF's MMIO GFN calculation (bsc#1124204). - lan78xx: Resolve issue with changing MAC address (bsc#1051510). - libertas_tf: prevent underflow in process_cmdrequest() (bsc#1119086). - lib/rbtree-test: lower default params (git-fixes). - lockd: fix access beyond unterminated strings in prints (git-fixes). - LSM: Check for NULL cred-security on free (bsc#1051510). - md: fix raid10 hang issue caused by barrier (git-fixes). - media: firewire: Fix app_info parameter type in avc_ca{,_app}_info (bsc#1051510). - media: usb: pwc: Do not use coherent DMA buffers for ISO transfer (bsc#1054610). - media: v4l2-tpg: array index could become negative (bsc#1051510). - media: v4l: ioctl: Validate num_planes for debug messages (bsc#1051510). - media: vb2: be sure to unlock mutex on errors (bsc#1051510). - media: vb2: vb2_mmap: move lock up (bsc#1051510). - media: vivid: fix error handling of kthread_run (bsc#1051510). - media: vivid: free bitmap_cap when updating std/timings/etc (bsc#1051510). - media: vivid: set min width/height to a value > 0 (bsc#1051510). - mfd: ab8500-core: Return zero in get_register_interruptible() (bsc#1051510). - mfd: tps6586x: Handle interrupts on suspend (bsc#1051510). - misc: atmel-ssc: Fix section annotation on atmel_ssc_get_driver_data (bsc#1051510). - misc: hmc6352: fix potential Spectre v1 (bsc#1051510). - misc: mic/scif: fix copy-paste error in scif_create_remote_lookup (bsc#1051510). - misc: mic: SCIF Fix scif_get_new_port() error handling (bsc#1051510). - misc: sram: enable clock before registering regions (bsc#1051510). - misc: sram: fix resource leaks in probe error path (bsc#1051510). - misc: ti-st: Fix memory leak in the error path of probe() (bsc#1051510). - misc: vexpress: Off by one in vexpress_syscfg_exec() (bsc#1051510). - mmc: atmel-mci: do not assume idle after atmci_request_end (bsc#1051510). - mmc: bcm2835: Fix DMA channel leak on probe error (bsc#1051510). - mmc: dw_mmc-bluefield: : Fix the license information (bsc#1051510). - mmc: sdhci-iproc: handle mmc_of_parse() errors during probe (bsc#1051510). - mm/huge_memory: fix lockdep complaint on 32-bit i_size_read() (VM Functionality, bsc#1121599). - mm/huge_memory: rename freeze_page() to unmap_page() (VM Functionality, bsc#1121599). - mm/huge_memory: splitting set mapping+index before unfreeze (VM Functionality, bsc#1121599). - mm/khugepaged: collapse_shmem() do not crash on Compound (VM Functionality, bsc#1121599). - mm/khugepaged: collapse_shmem() remember to clear holes (VM Functionality, bsc#1121599). - mm/khugepaged: collapse_shmem() stop if punched or truncated (VM Functionality, bsc#1121599). - mm/khugepaged: collapse_shmem() without freezing new_page (VM Functionality, bsc#1121599). - mm/khugepaged: fix crashes due to misaccounted holes (VM Functionality, bsc#1121599). - mm/khugepaged: minor reorderings in collapse_shmem() (VM Functionality, bsc#1121599). - mm: migrate: lock buffers before migrate_page_move_mapping() (bsc#1084216). - mm: migrate: Make buffer_migrate_page_norefs() actually succeed (bsc#1084216) - mm: migrate: provide buffer_migrate_page_norefs() (bsc#1084216). - mm: migration: factor out code to compute expected number of page references (bsc#1084216). - Move the upstreamed HD-audio fix into sorted section - mpt3sas: check sense buffer before copying sense data (bsc#1106811). - neighbour: Avoid writing before skb->head in neigh_hh_output() (networking-stable-18_12_12). - net: 8139cp: fix a BUG triggered by changing mtu with network traffic (networking-stable-18_12_12). - net: core: Fix Spectre v1 vulnerability (networking-stable-19_01_04). - net/hamradio/6pack: use mod_timer() to rearm timers (networking-stable-19_01_04). - net: hns3: add error handler for hns3_nic_init_vector_data() (bsc#1104353). - net: hns3: add handling for big TX fragment (bsc#1104353 ). - net: hns3: Fix client initialize state issue when roce client initialize failed (bsc#1104353). - net: hns3: Fix for loopback selftest failed problem (bsc#1104353 ). - net: hns3: fix for multiple unmapping DMA problem (bsc#1104353 ). - net: hns3: Fix tc setup when netdev is first up (bsc#1104353 ). - net: hns3: Fix tqp array traversal condition for vf (bsc#1104353 ). - net: hns3: move DMA map into hns3_fill_desc (bsc#1104353 ). - net: hns3: remove hns3_fill_desc_tso (bsc#1104353). - net: hns3: rename hns_nic_dma_unmap (bsc#1104353). - net: hns3: rename the interface for init_client_instance and uninit_client_instance (bsc#1104353). - net: macb: restart tx after tx used bit read (networking-stable-19_01_04). - net/mlx4_en: Change min MTU size to ETH_MIN_MTU (networking-stable-18_12_12). - net/mlx5e: Remove the false indication of software timestamping support (networking-stable-19_01_04). - net/mlx5: Typo fix in del_sw_hw_rule (networking-stable-19_01_04). - net: phy: do not allow __set_phy_supported to add unsupported modes (networking-stable-18_12_12). - net: phy: Fix the issue that netif always links up after resuming (networking-stable-19_01_04). - netrom: fix locking in nr_find_socket() (networking-stable-19_01_04). - net: skb_scrub_packet(): Scrub offload_fwd_mark (networking-stable-18_12_03). - net/smc: fix TCP fallback socket release (networking-stable-19_01_04). - net: stmmac: Fix PCI module removal leak (git-fixes). - net: thunderx: set tso_hdrs pointer to NULL in nicvf_free_snd_queue (networking-stable-18_12_03). - net: thunderx: set xdp_prog to NULL if bpf_prog_add fails (networking-stable-18_12_03). - net/wan: fix a double free in x25_asy_open_tty() (networking-stable-19_01_04). - nfsd: COPY and CLONE operations require the saved filehandle to be set (git-fixes). - nfsd: Fix an Oops in free_session() (git-fixes). - nfs: Fix a missed page unlock after pg_doio() (git-fixes). - NFS: Fix up return value on fatal errors in nfs_page_async_flush() (git-fixes). - NFSv4.1: Fix the r/wsize checking (git-fixes). - NFSv4: Do not exit the state manager without clearing NFS4CLNT_MANAGER_RUNNING (git-fixes). - nvme-multipath: round-robin I/O policy (bsc#1110705). - omap2fb: Fix stack memory disclosure (bsc#1120902) - packet: Do not leak dev refcounts on error exit (git-fixes). - packet: validate address length if non-zero (networking-stable-19_01_04). - packet: validate address length (networking-stable-19_01_04). - PCI: Disable broken RTIT_BAR of Intel TH (bsc#1120318). - phonet: af_phonet: Fix Spectre v1 vulnerability (networking-stable-19_01_04). - platform/x86: asus-nb-wmi: Drop mapping of 0x33 and 0x34 scan codes (bsc#1051510). - platform/x86: asus-nb-wmi: Map 0x35 to KEY_SCREENLOCK (bsc#1051510). - platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey (bsc#1051510). - powerpc: Always save/restore checkpointed regs during treclaim/trecheckpoint (bsc#1118338). - powerpc/cacheinfo: Report the correct shared_cpu_map on big-cores (bsc#1109695). - powerpc: Detect the presence of big-cores via "ibm, thread-groups" (bsc#1109695). - powerpc: make use of for_each_node_by_type() instead of open-coding it (bsc#1109695). - powerpc/powernv: Clear LPCR[PECE1] via stop-api only for deep state offline (bsc#1119766, bsc#1055121). - powerpc/powernv: Clear PECE1 in LPCR via stop-api only on Hotplug (bsc#1119766, bsc#1055121). - powerpc: Remove facility loadups on transactional {fp, vec, vsx} unavailable (bsc#1118338). - powerpc: Remove redundant FP/Altivec giveup code (bsc#1118338). - powerpc/setup: Add cpu_to_phys_id array (bsc#1109695). - powerpc/smp: Add cpu_l2_cache_map (bsc#1109695). - powerpc/smp: Add Power9 scheduler topology (bsc#1109695). - powerpc/smp: Rework CPU topology construction (bsc#1109695). - powerpc/smp: Use cpu_to_chip_id() to find core siblings (bsc#1109695). - powerpc/tm: Avoid machine crash on rt_sigreturn (bsc#1118338). - powerpc/tm: Do not check for WARN in TM Bad Thing handling (bsc#1118338). - powerpc/tm: Fix comment (bsc#1118338). - powerpc/tm: Fix endianness flip on trap (bsc#1118338). - powerpc/tm: Fix HFSCR bit for no suspend case (bsc#1118338). - powerpc/tm: Fix HTM documentation (bsc#1118338). - powerpc/tm: Limit TM code inside PPC_TRANSACTIONAL_MEM (bsc#1118338). - powerpc/tm: P9 disable transactionally suspended sigcontexts (bsc#1118338). - powerpc/tm: Print 64-bits MSR (bsc#1118338). - powerpc/tm: Print scratch value (bsc#1118338). - powerpc/tm: Reformat comments (bsc#1118338). - powerpc/tm: Remove msr_tm_active() (bsc#1118338). - powerpc/tm: Remove struct thread_info param from tm_reclaim_thread() (bsc#1118338). - powerpc/tm: Save MSR to PACA before RFID (bsc#1118338). - powerpc/tm: Set MSR[TS] just prior to recheckpoint (bsc#1118338, bsc#1120955). - powerpc/tm: Unset MSR[TS] if not recheckpointing (bsc#1118338). - powerpc/tm: Update function prototype comment (bsc#1118338). - powerpc: Use cpu_smallcore_sibling_mask at SMT level on bigcores (bsc#1109695). - powerpc/xmon: Fix invocation inside lock region (bsc#1122885). - pstore/ram: Avoid allocation and leak of platform data (bsc#1051510). - pstore/ram: Avoid NULL deref in ftrace merging failure path (bsc#1051510). - pstore/ram: Correctly calculate usable PRZ bytes (bsc#1051510). - pstore/ram: Do not treat empty buffers as valid (bsc#1051510). - ptp_kvm: probe for kvm guest availability (bsc#1098382). - ptr_ring: wrap back ->producer in __ptr_ring_swap_queue() (networking-stable-19_01_04). - qed: Avoid constant logical operation warning in qed_vf_pf_acquire (bsc#1086314 bsc#1086313 bsc#1086301). - qed: Avoid implicit enum conversion in qed_iwarp_parse_rx_pkt (bsc#1086314 bsc#1086313 bsc#1086301 ). - qed: Avoid implicit enum conversion in qed_roce_mode_to_flavor (bsc#1086314 bsc#1086313 bsc#1086301 ). - qed: Avoid implicit enum conversion in qed_set_tunn_cls_info (bsc#1086314 bsc#1086313 bsc#1086301 ). - qed: Fix an error code qed_ll2_start_xmit() (bsc#1086314 bsc#1086313 bsc#1086301). - qed: Fix bitmap_weight() check (bsc#1086314 bsc#1086313 bsc#1086301). - qed: Fix blocking/unlimited SPQ entries leak (bsc#1086314 bsc#1086313 bsc#1086301). - qed: Fix command number mismatch between driver and the mfw (bsc#1086314 bsc#1086313 bsc#1086301 ). - qed: Fix mask parameter in qed_vf_prep_tunn_req_tlv (bsc#1086314 bsc#1086313 bsc#1086301). - qed: Fix memory/entry leak in qed_init_sp_request() (bsc#1086314 bsc#1086313 bsc#1086301). - qed: Fix potential memory corruption (bsc#1086314 bsc#1086313 bsc#1086301). - qed: Fix PTT leak in qed_drain() (bsc#1086314 bsc#1086313 bsc#1086301). - qed: Fix QM getters to always return a valid pq (bsc#1086314 bsc#1086313 bsc#1086301). - qed: Fix rdma_info structure allocation (bsc#1086314 bsc#1086313 bsc#1086301). - qed: Fix reading wrong value in loop condition (bsc#1086314 bsc#1086313 bsc#1086301). - qla2xxx: Fixup dual-protocol FCP connections (bsc#1108870). - qmi_wwan: Added support for Fibocom NL668 series (networking-stable-19_01_04). - qmi_wwan: Added support for Telit LN940 series (networking-stable-19_01_04). - qmi_wwan: Add support for Fibocom NL678 series (networking-stable-19_01_04). - rapidio/rionet: do not free skb before reading its length (networking-stable-18_12_03). - RDMA/core: Fix unwinding flow in case of error to register device (bsc#1046306). - Revert "serial: 8250: Fix clearing FIFOs in RS485 mode again" (bsc#1051510). - rpm/release-projects: Add SUSE:Maintenance:* for MU kernels (bsc#1123317) - rtnetlink: ndo_dflt_fdb_dump() only work for ARPHRD_ETHER devices (networking-stable-18_12_12). - s390/zcrypt: fix specification exception on z196 during ap probe (LTC#174936, bsc#1123061). - sbus: char: add of_node_put() (bsc#1051510). - sched/wait: Fix rcuwait_wake_up() ordering (git-fixes). - scripts/git_sort/git_sort.py: Add mkp/scsi 5.0/scsi-fixes - scripts/git_sort/git_sort.py: Add s390/linux.git fixes. - scsi: qedi: Add ep_state for login completion on un-reachable targets (bsc#1113712). - scsi: qla2xxx: Timeouts occur on surprise removal of QLogic adapter (bsc#1124985). - scsi: target: make the pi_prot_format ConfigFS path readable (bsc#1123933). - sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event (networking-stable-19_01_04). - sctp: kfree_rcu asoc (networking-stable-18_12_12). - selftests/powerpc: Use snprintf to construct DSCR sysfs interface paths (bsc#1124579). - selinux: Add __GFP_NOWARN to allocation at str_read() (bsc#1051510). - selinux: fix GPF on invalid policy (bsc#1051510). - serial: imx: fix error handling in console_setup (bsc#1051510). - serial: set suppress_bind_attrs flag only if builtin (bsc#1051510). - serial/sunsu: fix refcount leak (bsc#1051510). - serial: uartps: Fix interrupt mask issue to handle the RX interrupts properly (bsc#1051510). - shmem: introduce shmem_inode_acct_block (VM Functionality, bsc#1121599). - shmem: shmem_charge: verify max_block is not exceeded before inode update (VM Functionality, bsc#1121599). - signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid namespace init (git-fixes). - slab: alien caches must not be initialized if the allocation of the alien cache failed (git fixes (mm/slab)). - smb3.1.1 dialect is no longer experimental (bsc#1051510). - smb311: Fix reconnect (bsc#1051510). - smb3: Add support for multidialect negotiate (SMB2.1 and later) (bsc#1051510). - smb3: allow stats which track session and share reconnects to be reset (bsc#1051510). - smb3: Backup intent flag missing for directory opens with backupuid mounts (bsc#1051510). - smb3: check for and properly advertise directory lease support (bsc#1051510). - smb3: directory sync should not return an error (bsc#1051510). - smb3: do not attempt cifs operation in smb3 query info error path (bsc#1051510). - smb3: do not request leases in symlink creation and query (bsc#1051510). - smb3: Do not send SMB3 SET_INFO if nothing changed (bsc#1051510). - smb3: enumerating snapshots was leaving part of the data off end (bsc#1051510). - smb3: Fix length checking of SMB3.11 negotiate request (bsc#1051510). - smb3: Fix root directory when server returns inode number of zero (bsc#1051510). - smb3: fix various xid leaks (bsc#1051510). - smb3: Improve security, move default dialect to SMB3 from old CIFS (bsc#1051510). - smb3: on kerberos mount if server does not specify auth type use krb5 (bsc#1051510). - smb3: Remove ifdef since SMB3 (and later) now STRONGLY preferred (bsc#1051510). - smb3: simplify code by removing CONFIG_CIFS_SMB311 (bsc#1051510). - staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1 (bsc#1051510). - sunrpc: correct the computation for page_ptr when truncating (git-fixes). - sunrpc: Fix a potential race in xprt_connect() (git-fixes). - sunrpc: Fix leak of krb5p encode pages (git-fixes). - sunrpc: handle ENOMEM in rpcb_getport_async (git-fixes). - sunrpc: safely reallow resvport min/max inversion (git-fixes). - tcp: Do not underestimate rwnd_limited (networking-stable-18_12_12). - tcp: fix a race in inet_diag_dump_icsk() (networking-stable-19_01_04). - tcp: fix NULL ref in tail loss probe (networking-stable-18_12_12). - tcp: lack of available data can also cause TSO defer (git-fixes). - thermal: int340x_thermal: Fix a NULL vs IS_ERR() check (bsc#1051510). - tipc: compare remote and local protocols in tipc_udp_enable() (networking-stable-19_01_04). - tipc: fix a double kfree_skb() (networking-stable-19_01_04). - tipc: use lock_sock() in tipc_sk_reinit() (networking-stable-19_01_04). - tools/lib/lockdep: Rename "trywlock" into "trywrlock" (bsc#1121973). - tty: Do not hold ldisc lock in tty_reopen() if ldisc present (bsc#1051510). - tty: Handle problem if line discipline does not have receive_buf (bsc#1051510). - tty/n_hdlc: fix __might_sleep warning (bsc#1051510). - tty/serial: do not free trasnmit buffer page under port lock (bsc#1051510). - tun: forbid iface creation with rtnl ops (networking-stable-18_12_12). - uart: Fix crash in uart_write and uart_put_char (bsc#1051510). - usb: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB (bsc#1120902). - usb: cdc-acm: send ZLP for Telit 3G Intel based modems (bsc#1120902). - usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup (bsc#1120902). - usb: dwc3: trace: add missing break statement to make compiler happy (bsc#1120902). - usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2 (networking-stable-18_12_03). - usb: serial: option: add Fibocom NL678 series (bsc#1120902). - usb: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays (bsc#1120902). - usb: storage: add quirk for SMI SM3350 (bsc#1120902). - usb: storage: do not insert sane sense for SPC3+ when bad sense specified (bsc#1120902). - usb: xhci: fix 'broken_suspend' placement in struct xchi_hcd (bsc#1119086). - vfs: Avoid softlockups in drop_pagecache_sb() (bsc#1118505). - vhost: make sure used idx is seen before log in vhost_add_used_n() (networking-stable-19_01_04). - virtio-net: fail XDP set if guest csum is negotiated (networking-stable-18_12_03). - virtio-net: keep vnet header zeroed after processing XDP (networking-stable-18_12_12). - vsock: Send reset control packet when socket is partially bound (networking-stable-19_01_04). - vt: invoke notifier on screen size change (bsc#1051510). - watchdog: w83627hf_wdt: Add quirk for Inves system (bsc#1106434). - writeback: do not decrement wb->refcnt if !wb->bdi (git fixes (writeback)). - x86/bugs: Add AMD's variant of SSB_NO (bsc#1114279). - x86/bugs: Update when to check for the LS_CFG SSBD mitigation (bsc#1114279). - x86/kvmclock: set pvti_cpu0_va after enabling kvmclock (bsc#1098382). - x86/MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out() (bsc#1114279). - x86/microcode/amd: Do not falsely trick the late loading mechanism (bsc#1114279). - x86/mm: Drop usage of __flush_tlb_all() in kernel_physical_mapping_init() (bsc#1114279). - x86, modpost: Replace last remnants of RETPOLINE with CONFIG_RETPOLINE (bsc#1114279). - x86/pvclock: add setter for pvclock_pvti_cpu0_va (bsc#1098382). - x86/resctrl: Fix rdt_find_domain() return value and checks (bsc#1114279). - x86/speculation: Add RETPOLINE_AMD support to the inline asm CALL_NOSPEC variant (bsc#1114279). - x86/speculation: Remove redundant arch_smt_update() invocation (bsc#1114279). - x86/xen/time: Output xen sched_clock time from 0 (bsc#1098382). - x86/xen/time: set pvclock flags on xen_time_init() (bsc#1098382). - x86/xen/time: setup vcpu 0 time info page (bsc#1098382). - xen: Fix x86 sched_clock() interface for xen (bsc#1098382). - xhci: Add quirk to zero 64bit registers on Renesas PCIe controllers (bsc#1120854). - xhci: workaround CSS timeout on AMD SNPS 3.0 xHC (bsc#1119086). - xprtrdma: Reset credit grant properly after a disconnect (git-fixes). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-203=1 Package List: - openSUSE Leap 15.0 (noarch): kernel-devel-4.12.14-lp150.12.48.1 kernel-docs-4.12.14-lp150.12.48.1 kernel-docs-html-4.12.14-lp150.12.48.1 kernel-macros-4.12.14-lp150.12.48.1 kernel-source-4.12.14-lp150.12.48.1 kernel-source-vanilla-4.12.14-lp150.12.48.1 - openSUSE Leap 15.0 (x86_64): kernel-debug-4.12.14-lp150.12.48.1 kernel-debug-base-4.12.14-lp150.12.48.1 kernel-debug-base-debuginfo-4.12.14-lp150.12.48.1 kernel-debug-debuginfo-4.12.14-lp150.12.48.1 kernel-debug-debugsource-4.12.14-lp150.12.48.1 kernel-debug-devel-4.12.14-lp150.12.48.1 kernel-debug-devel-debuginfo-4.12.14-lp150.12.48.1 kernel-default-4.12.14-lp150.12.48.1 kernel-default-base-4.12.14-lp150.12.48.1 kernel-default-base-debuginfo-4.12.14-lp150.12.48.1 kernel-default-debuginfo-4.12.14-lp150.12.48.1 kernel-default-debugsource-4.12.14-lp150.12.48.1 kernel-default-devel-4.12.14-lp150.12.48.1 kernel-default-devel-debuginfo-4.12.14-lp150.12.48.1 kernel-kvmsmall-4.12.14-lp150.12.48.1 kernel-kvmsmall-base-4.12.14-lp150.12.48.1 kernel-kvmsmall-base-debuginfo-4.12.14-lp150.12.48.1 kernel-kvmsmall-debuginfo-4.12.14-lp150.12.48.1 kernel-kvmsmall-debugsource-4.12.14-lp150.12.48.1 kernel-kvmsmall-devel-4.12.14-lp150.12.48.1 kernel-kvmsmall-devel-debuginfo-4.12.14-lp150.12.48.1 kernel-obs-build-4.12.14-lp150.12.48.1 kernel-obs-build-debugsource-4.12.14-lp150.12.48.1 kernel-obs-qa-4.12.14-lp150.12.48.1 kernel-syms-4.12.14-lp150.12.48.1 kernel-vanilla-4.12.14-lp150.12.48.1 kernel-vanilla-base-4.12.14-lp150.12.48.1 kernel-vanilla-base-debuginfo-4.12.14-lp150.12.48.1 kernel-vanilla-debuginfo-4.12.14-lp150.12.48.1 kernel-vanilla-debugsource-4.12.14-lp150.12.48.1 kernel-vanilla-devel-4.12.14-lp150.12.48.1 kernel-vanilla-devel-debuginfo-4.12.14-lp150.12.48.1 References: https://www.suse.com/security/cve/CVE-2018-20669.html https://www.suse.com/security/cve/CVE-2019-3459.html https://www.suse.com/security/cve/CVE-2019-3460.html https://www.suse.com/security/cve/CVE-2019-6974.html https://www.suse.com/security/cve/CVE-2019-7221.html https://www.suse.com/security/cve/CVE-2019-7222.html https://bugzilla.suse.com/1046306 https://bugzilla.suse.com/1050252 https://bugzilla.suse.com/1051510 https://bugzilla.suse.com/1054610 https://bugzilla.suse.com/1055121 https://bugzilla.suse.com/1056658 https://bugzilla.suse.com/1056662 https://bugzilla.suse.com/1084216 https://bugzilla.suse.com/1086301 https://bugzilla.suse.com/1086313 https://bugzilla.suse.com/1086314 https://bugzilla.suse.com/1086323 https://bugzilla.suse.com/1087082 https://bugzilla.suse.com/1087092 https://bugzilla.suse.com/1098382 https://bugzilla.suse.com/1098425 https://bugzilla.suse.com/1104353 https://bugzilla.suse.com/1106105 https://bugzilla.suse.com/1106434 https://bugzilla.suse.com/1106811 https://bugzilla.suse.com/1108870 https://bugzilla.suse.com/1109695 https://bugzilla.suse.com/1110705 https://bugzilla.suse.com/1111666 https://bugzilla.suse.com/1113712 https://bugzilla.suse.com/1113722 https://bugzilla.suse.com/1114279 https://bugzilla.suse.com/1117155 https://bugzilla.suse.com/1118338 https://bugzilla.suse.com/1118505 https://bugzilla.suse.com/1119086 https://bugzilla.suse.com/1119766 https://bugzilla.suse.com/1120318 https://bugzilla.suse.com/1120758 https://bugzilla.suse.com/1120854 https://bugzilla.suse.com/1120902 https://bugzilla.suse.com/1120954 https://bugzilla.suse.com/1120955 https://bugzilla.suse.com/1121599 https://bugzilla.suse.com/1121726 https://bugzilla.suse.com/1121973 https://bugzilla.suse.com/1122019 https://bugzilla.suse.com/1122324 https://bugzilla.suse.com/1122554 https://bugzilla.suse.com/1122662 https://bugzilla.suse.com/1122779 https://bugzilla.suse.com/1122885 https://bugzilla.suse.com/1122927 https://bugzilla.suse.com/1122944 https://bugzilla.suse.com/1122971 https://bugzilla.suse.com/1123061 https://bugzilla.suse.com/1123317 https://bugzilla.suse.com/1123348 https://bugzilla.suse.com/1123357 https://bugzilla.suse.com/1123538 https://bugzilla.suse.com/1123697 https://bugzilla.suse.com/1123933 https://bugzilla.suse.com/1124204 https://bugzilla.suse.com/1124579 https://bugzilla.suse.com/1124589 https://bugzilla.suse.com/1124728 https://bugzilla.suse.com/1124732 https://bugzilla.suse.com/1124735 https://bugzilla.suse.com/1124969 https://bugzilla.suse.com/1124985 https://bugzilla.suse.com/1125109 https://bugzilla.suse.com/802154 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0206-1: important: Security update for chromium
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0206-1 Rating: important References: #1123641 #1124936 Cross-References: CVE-2019-5754 CVE-2019-5755 CVE-2019-5756 CVE-2019-5757 CVE-2019-5758 CVE-2019-5759 CVE-2019-5760 CVE-2019-5761 CVE-2019-5762 CVE-2019-5763 CVE-2019-5764 CVE-2019-5765 CVE-2019-5766 CVE-2019-5767 CVE-2019-5768 CVE-2019-5769 CVE-2019-5770 CVE-2019-5771 CVE-2019-5772 CVE-2019-5773 CVE-2019-5774 CVE-2019-5775 CVE-2019-5776 CVE-2019-5777 CVE-2019-5778 CVE-2019-5779 CVE-2019-5780 CVE-2019-5781 CVE-2019-5782 CVE-2019-5784 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 30 vulnerabilities is now available. Description: This update for Chromium to version 72.0.3626.96 fixes the following issues: Security issues fixed (bsc#1123641 and bsc#1124936): - CVE-2019-5784: Inappropriate implementation in V8 - CVE-2019-5754: Inappropriate implementation in QUIC Networking. - CVE-2019-5782: Inappropriate implementation in V8. - CVE-2019-5755: Inappropriate implementation in V8. - CVE-2019-5756: Use after free in PDFium. - CVE-2019-5757: Type Confusion in SVG. - CVE-2019-5758: Use after free in Blink. - CVE-2019-5759: Use after free in HTML select elements. - CVE-2019-5760: Use after free in WebRTC. - CVE-2019-5761: Use after free in SwiftShader. - CVE-2019-5762: Use after free in PDFium. - CVE-2019-5763: Insufficient validation of untrusted input in V8. - CVE-2019-5764: Use after free in WebRTC. - CVE-2019-5765: Insufficient policy enforcement in the browser. - CVE-2019-5766: Insufficient policy enforcement in Canvas. - CVE-2019-5767: Incorrect security UI in WebAPKs. - CVE-2019-5768: Insufficient policy enforcement in DevTools. - CVE-2019-5769: Insufficient validation of untrusted input in Blink. - CVE-2019-5770: Heap buffer overflow in WebGL. - CVE-2019-5771: Heap buffer overflow in SwiftShader. - CVE-2019-5772: Use after free in PDFium. - CVE-2019-5773: Insufficient data validation in IndexedDB. - CVE-2019-5774: Insufficient validation of untrusted input in SafeBrowsing. - CVE-2019-5775: Insufficient policy enforcement in Omnibox. - CVE-2019-5776: Insufficient policy enforcement in Omnibox. - CVE-2019-5777: Insufficient policy enforcement in Omnibox. - CVE-2019-5778: Insufficient policy enforcement in Extensions. - CVE-2019-5779: Insufficient policy enforcement in ServiceWorker. - CVE-2019-5780: Insufficient policy enforcement. - CVE-2019-5781: Insufficient policy enforcement in Omnibox. For a full list of changes refer to https://chromereleases.googleblog.com/2019/02/stable-channel-update-for-des ktop.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-206=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-72.0.3626.96-88.1 chromedriver-debuginfo-72.0.3626.96-88.1 chromium-72.0.3626.96-88.1 chromium-debuginfo-72.0.3626.96-88.1 chromium-debugsource-72.0.3626.96-88.1 References: https://www.suse.com/security/cve/CVE-2019-5754.html https://www.suse.com/security/cve/CVE-2019-5755.html https://www.suse.com/security/cve/CVE-2019-5756.html https://www.suse.com/security/cve/CVE-2019-5757.html https://www.suse.com/security/cve/CVE-2019-5758.html https://www.suse.com/security/cve/CVE-2019-5759.html https://www.suse.com/security/cve/CVE-2019-5760.html https://www.suse.com/security/cve/CVE-2019-5761.html https://www.suse.com/security/cve/CVE-2019-5762.html https://www.suse.com/security/cve/CVE-2019-5763.html https://www.suse.com/security/cve/CVE-2019-5764.html https://www.suse.com/security/cve/CVE-2019-5765.html https://www.suse.com/security/cve/CVE-2019-5766.html https://www.suse.com/security/cve/CVE-2019-5767.html https://www.suse.com/security/cve/CVE-2019-5768.html https://www.suse.com/security/cve/CVE-2019-5769.html https://www.suse.com/security/cve/CVE-2019-5770.html https://www.suse.com/security/cve/CVE-2019-5771.html https://www.suse.com/security/cve/CVE-2019-5772.html https://www.suse.com/security/cve/CVE-2019-5773.html https://www.suse.com/security/cve/CVE-2019-5774.html https://www.suse.com/security/cve/CVE-2019-5775.html https://www.suse.com/security/cve/CVE-2019-5776.html https://www.suse.com/security/cve/CVE-2019-5777.html https://www.suse.com/security/cve/CVE-2019-5778.html https://www.suse.com/security/cve/CVE-2019-5779.html https://www.suse.com/security/cve/CVE-2019-5780.html https://www.suse.com/security/cve/CVE-2019-5781.html https://www.suse.com/security/cve/CVE-2019-5782.html https://www.suse.com/security/cve/CVE-2019-5784.html https://bugzilla.suse.com/1123641 https://bugzilla.suse.com/1124936 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0200-1: critical: Security update for LibVNCServer
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for LibVNCServer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0200-1 Rating: critical References: #1123823 #1123828 #1123832 Cross-References: CVE-2018-20748 CVE-2018-20749 CVE-2018-20750 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for LibVNCServer fixes the following issues: Security issues fixed: - CVE-2018-20749: Fixed a heap out of bounds write vulnerability in rfbserver.c (bsc#1123828) - CVE-2018-20750: Fixed a heap out of bounds write vulnerability in rfbserver.c (bsc#1123832) - CVE-2018-20748: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1123823) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-200=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): LibVNCServer-debugsource-0.9.9-16.9.1 LibVNCServer-devel-0.9.9-16.9.1 libvncclient0-0.9.9-16.9.1 libvncclient0-debuginfo-0.9.9-16.9.1 libvncserver0-0.9.9-16.9.1 libvncserver0-debuginfo-0.9.9-16.9.1 linuxvnc-0.9.9-16.9.1 linuxvnc-debuginfo-0.9.9-16.9.1 References: https://www.suse.com/security/cve/CVE-2018-20748.html https://www.suse.com/security/cve/CVE-2018-20749.html https://www.suse.com/security/cve/CVE-2018-20750.html https://bugzilla.suse.com/1123823 https://bugzilla.suse.com/1123828 https://bugzilla.suse.com/1123832 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0202-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0202-1 Rating: important References: #1125330 Cross-References: CVE-2018-18335 CVE-2018-18356 CVE-2019-5785 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for MozillaFirefox to version 60.5.1 fixes the following issues: Security issues fixed (bsc#1125330): - CVE-2018-18356: Fixed a use-after-free vulnerability in Skia library. - CVE-2019-5785: Fixed an integer overflow in the Skia library. - CVE-2018-18335: Fixed a buffer overflow in Skia library with accelerated Canvas 2D by disabling Canvas 2D. This vulnerability does not affect Linux platform. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-202=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-60.5.1-131.1 MozillaFirefox-branding-upstream-60.5.1-131.1 MozillaFirefox-buildsymbols-60.5.1-131.1 MozillaFirefox-debuginfo-60.5.1-131.1 MozillaFirefox-debugsource-60.5.1-131.1 MozillaFirefox-devel-60.5.1-131.1 MozillaFirefox-translations-common-60.5.1-131.1 MozillaFirefox-translations-other-60.5.1-131.1 References: https://www.suse.com/security/cve/CVE-2018-18335.html https://www.suse.com/security/cve/CVE-2018-18356.html https://www.suse.com/security/cve/CVE-2019-5785.html https://bugzilla.suse.com/1125330 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0195-1: moderate: Security update for nginx
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for nginx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0195-1 Rating: moderate References: #1115015 #1115022 #1115025 Cross-References: CVE-2018-16843 CVE-2018-16844 CVE-2018-16845 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nginx fixes the following issues: nginx was updated to 1.14.2: - Bugfix: nginx could not be built on Fedora 28 Linux. - Bugfix: in handling of client addresses when using unix domain listen sockets to work with datagrams on Linux. - Change: the logging level of the "http request", "https proxy request", "unsupported protocol", "version too low", "no suitable key share", and "no suitable signature algorithm" SSL errors has been lowered from "crit" to "info". - Bugfix: when using OpenSSL 1.1.0 or newer it was not possible to switch off "ssl_prefer_server_ciphers" in a virtual server if it was switched on in the default server. - Bugfix: nginx could not be built with LibreSSL 2.8.0. - Bugfix: if nginx was built with OpenSSL 1.1.0 and used with OpenSSL 1.1.1, the TLS 1.3 protocol was always enabled. - Bugfix: sending a disk-buffered request body to a gRPC backend might fail. - Bugfix: connections with some gRPC backends might not be cached when using the "keepalive" directive. - Bugfix: a segmentation fault might occur in a worker process if the ngx_http_mp4_module was used on 32-bit platforms. Changes with nginx 1.14.1: - Security: when using HTTP/2 a client might cause excessive memory consumption (CVE-2018-16843) and CPU usage (CVE-2018-16844). - Security: processing of a specially crafted mp4 file with the ngx_http_mp4_module might result in worker process memory disclosure (CVE-2018-16845). - Bugfix: working with gRPC backends might result in excessive memory consumption. Changes with nginx 1.13.12: - Bugfix: connections with gRPC backends might be closed unexpectedly when returning a large response. Changes with nginx 1.13.10 - Feature: the "set" parameter of the "include" SSI directive now allows writing arbitrary responses to a variable; the "subrequest_output_buffer_size" directive defines maximum response size. - Feature: now nginx uses clock_gettime(CLOCK_MONOTONIC) if available, to avoid timeouts being incorrectly triggered on system time changes. - Feature: the "escape=none" parameter of the "log_format" directive. Thanks to Johannes Baiter and Calin Don. - Feature: the $ssl_preread_alpn_protocols variable in the ngx_stream_ssl_preread_module. - Feature: the ngx_http_grpc_module. - Bugfix: in memory allocation error handling in the "geo" directive. - Bugfix: when using variables in the "auth_basic_user_file" directive a null character might appear in logs. Thanks to Vadim Filimonov. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-195=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-195=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-195=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): nginx-1.14.2-2.7.1 nginx-debuginfo-1.14.2-2.7.1 nginx-debugsource-1.14.2-2.7.1 - openSUSE Leap 42.3 (noarch): vim-plugin-nginx-1.14.2-2.7.1 - openSUSE Leap 15.0 (noarch): vim-plugin-nginx-1.14.2-lp150.2.4.1 - openSUSE Leap 15.0 (x86_64): nginx-1.14.2-lp150.2.4.1 nginx-debuginfo-1.14.2-lp150.2.4.1 nginx-debugsource-1.14.2-lp150.2.4.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): nginx-1.14.2-16.1 nginx-debuginfo-1.14.2-16.1 nginx-debugsource-1.14.2-16.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): vim-plugin-nginx-1.14.2-16.1 References: https://www.suse.com/security/cve/CVE-2018-16843.html https://www.suse.com/security/cve/CVE-2018-16844.html https://www.suse.com/security/cve/CVE-2018-16845.html https://bugzilla.suse.com/1115015 https://bugzilla.suse.com/1115022 https://bugzilla.suse.com/1115025 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0194-1: important: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0194-1 Rating: important References: #1123271 #1123272 Cross-References: CVE-2019-6798 CVE-2019-6799 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for phpMyAdmin to version 4.8.5 fixes the following issues: Security issues fixed: - CVE-2019-6799: Fixed an arbitrary file read vulnerability (boo#1123272) - CVE-2019-6798: Fixed a SQL injection in the designer interface (boo#1123271) Other changes: * Fix rxport to SQL format not available * Fix QR code not shown when adding two-factor authentication to a user account * Fix issue with adding a new user in MySQL 8.0.11 and newer * Fix frozen interface relating to Text_Plain_Sql plugin * Fix missing table level operations tab Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-194=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-194=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-194=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-194=1 Package List: - openSUSE Leap 42.3 (noarch): phpMyAdmin-4.8.5-27.1 - openSUSE Leap 15.0 (noarch): phpMyAdmin-4.8.5-lp150.2.15.1 - openSUSE Backports SLE-15 (noarch): phpMyAdmin-4.8.5-bp150.3.9.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.8.5-35.1 References: https://www.suse.com/security/cve/CVE-2019-6798.html https://www.suse.com/security/cve/CVE-2019-6799.html https://bugzilla.suse.com/1123271 https://bugzilla.suse.com/1123272 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0195-1: moderate: Security update for nginx
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for nginx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0195-1 Rating: moderate References: #1115015 #1115022 #1115025 Cross-References: CVE-2018-16843 CVE-2018-16844 CVE-2018-16845 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nginx fixes the following issues: nginx was updated to 1.14.2: - Bugfix: nginx could not be built on Fedora 28 Linux. - Bugfix: in handling of client addresses when using unix domain listen sockets to work with datagrams on Linux. - Change: the logging level of the "http request", "https proxy request", "unsupported protocol", "version too low", "no suitable key share", and "no suitable signature algorithm" SSL errors has been lowered from "crit" to "info". - Bugfix: when using OpenSSL 1.1.0 or newer it was not possible to switch off "ssl_prefer_server_ciphers" in a virtual server if it was switched on in the default server. - Bugfix: nginx could not be built with LibreSSL 2.8.0. - Bugfix: if nginx was built with OpenSSL 1.1.0 and used with OpenSSL 1.1.1, the TLS 1.3 protocol was always enabled. - Bugfix: sending a disk-buffered request body to a gRPC backend might fail. - Bugfix: connections with some gRPC backends might not be cached when using the "keepalive" directive. - Bugfix: a segmentation fault might occur in a worker process if the ngx_http_mp4_module was used on 32-bit platforms. Changes with nginx 1.14.1: - Security: when using HTTP/2 a client might cause excessive memory consumption (CVE-2018-16843) and CPU usage (CVE-2018-16844). - Security: processing of a specially crafted mp4 file with the ngx_http_mp4_module might result in worker process memory disclosure (CVE-2018-16845). - Bugfix: working with gRPC backends might result in excessive memory consumption. Changes with nginx 1.13.12: - Bugfix: connections with gRPC backends might be closed unexpectedly when returning a large response. Changes with nginx 1.13.10 - Feature: the "set" parameter of the "include" SSI directive now allows writing arbitrary responses to a variable; the "subrequest_output_buffer_size" directive defines maximum response size. - Feature: now nginx uses clock_gettime(CLOCK_MONOTONIC) if available, to avoid timeouts being incorrectly triggered on system time changes. - Feature: the "escape=none" parameter of the "log_format" directive. Thanks to Johannes Baiter and Calin Don. - Feature: the $ssl_preread_alpn_protocols variable in the ngx_stream_ssl_preread_module. - Feature: the ngx_http_grpc_module. - Bugfix: in memory allocation error handling in the "geo" directive. - Bugfix: when using variables in the "auth_basic_user_file" directive a null character might appear in logs. Thanks to Vadim Filimonov. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-195=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-195=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): nginx-1.14.2-2.7.1 nginx-debuginfo-1.14.2-2.7.1 nginx-debugsource-1.14.2-2.7.1 - openSUSE Leap 42.3 (noarch): vim-plugin-nginx-1.14.2-2.7.1 - openSUSE Leap 15.0 (x86_64): nginx-1.14.2-lp150.2.4.1 nginx-debuginfo-1.14.2-lp150.2.4.1 nginx-debugsource-1.14.2-lp150.2.4.1 - openSUSE Leap 15.0 (noarch): vim-plugin-nginx-1.14.2-lp150.2.4.1 References: https://www.suse.com/security/cve/CVE-2018-16843.html https://www.suse.com/security/cve/CVE-2018-16844.html https://www.suse.com/security/cve/CVE-2018-16845.html https://bugzilla.suse.com/1115015 https://bugzilla.suse.com/1115022 https://bugzilla.suse.com/1115025 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0199-1: Security update for libu2f-host
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for libu2f-host ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0199-1 Rating: low References: #1124781 Cross-References: CVE-2018-20340 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libu2f-host fixes the following issues: Security issue fixed: - CVE-2018-20340: Fixed an unchecked buffer, which could allow a buffer overflow with a custom made malicious USB device (bsc#1124781). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-199=1 Package List: - openSUSE Leap 42.3 (x86_64): libu2f-host-debugsource-1.0.0-5.3.1 libu2f-host-devel-1.0.0-5.3.1 libu2f-host-doc-1.0.0-5.3.1 libu2f-host0-1.0.0-5.3.1 libu2f-host0-debuginfo-1.0.0-5.3.1 u2f-host-1.0.0-5.3.1 u2f-host-debuginfo-1.0.0-5.3.1 References: https://www.suse.com/security/cve/CVE-2018-20340.html https://bugzilla.suse.com/1124781 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0197-1: moderate: Security update for avahi
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for avahi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0197-1 Rating: moderate References: #1120281 Cross-References: CVE-2018-1000845 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for avahi fixes the following issues: Security issue fixed: - CVE-2018-1000845: Fixed DNS amplification and reflection to spoofed addresses (DOS) (bsc#1120281) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-197=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): avahi-0.6.32-lp150.4.3.1 avahi-autoipd-0.6.32-lp150.4.3.1 avahi-autoipd-debuginfo-0.6.32-lp150.4.3.1 avahi-compat-howl-devel-0.6.32-lp150.4.3.1 avahi-compat-mDNSResponder-devel-0.6.32-lp150.4.3.1 avahi-debuginfo-0.6.32-lp150.4.3.1 avahi-debugsource-0.6.32-lp150.4.3.1 avahi-glib2-debugsource-0.6.32-lp150.4.3.1 avahi-utils-0.6.32-lp150.4.3.1 avahi-utils-debuginfo-0.6.32-lp150.4.3.1 avahi-utils-gtk-0.6.32-lp150.4.3.1 avahi-utils-gtk-debuginfo-0.6.32-lp150.4.3.1 libavahi-client3-0.6.32-lp150.4.3.1 libavahi-client3-debuginfo-0.6.32-lp150.4.3.1 libavahi-common3-0.6.32-lp150.4.3.1 libavahi-common3-debuginfo-0.6.32-lp150.4.3.1 libavahi-core7-0.6.32-lp150.4.3.1 libavahi-core7-debuginfo-0.6.32-lp150.4.3.1 libavahi-devel-0.6.32-lp150.4.3.1 libavahi-glib-devel-0.6.32-lp150.4.3.1 libavahi-glib1-0.6.32-lp150.4.3.1 libavahi-glib1-debuginfo-0.6.32-lp150.4.3.1 libavahi-gobject-devel-0.6.32-lp150.4.3.1 libavahi-gobject0-0.6.32-lp150.4.3.1 libavahi-gobject0-debuginfo-0.6.32-lp150.4.3.1 libavahi-ui-gtk3-0-0.6.32-lp150.4.3.1 libavahi-ui-gtk3-0-debuginfo-0.6.32-lp150.4.3.1 libavahi-ui0-0.6.32-lp150.4.3.1 libavahi-ui0-debuginfo-0.6.32-lp150.4.3.1 libdns_sd-0.6.32-lp150.4.3.1 libdns_sd-debuginfo-0.6.32-lp150.4.3.1 libhowl0-0.6.32-lp150.4.3.1 libhowl0-debuginfo-0.6.32-lp150.4.3.1 python-avahi-0.6.32-lp150.4.3.1 python-avahi-gtk-0.6.32-lp150.4.3.1 typelib-1_0-Avahi-0_6-0.6.32-lp150.4.3.1 - openSUSE Leap 15.0 (noarch): avahi-lang-0.6.32-lp150.4.3.1 - openSUSE Leap 15.0 (x86_64): avahi-32bit-debuginfo-0.6.32-lp150.4.3.1 avahi-mono-0.6.32-lp150.4.3.1 avahi-qt4-debugsource-0.6.32-lp150.4.3.1 libavahi-client3-32bit-0.6.32-lp150.4.3.1 libavahi-client3-32bit-debuginfo-0.6.32-lp150.4.3.1 libavahi-common3-32bit-0.6.32-lp150.4.3.1 libavahi-common3-32bit-debuginfo-0.6.32-lp150.4.3.1 libavahi-glib1-32bit-0.6.32-lp150.4.3.1 libavahi-glib1-32bit-debuginfo-0.6.32-lp150.4.3.1 libavahi-qt4-1-0.6.32-lp150.4.3.1 libavahi-qt4-1-debuginfo-0.6.32-lp150.4.3.1 libavahi-qt4-devel-0.6.32-lp150.4.3.1 libdns_sd-32bit-0.6.32-lp150.4.3.1 libdns_sd-32bit-debuginfo-0.6.32-lp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000845.html https://bugzilla.suse.com/1120281 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0196-1: critical: Security update for LibVNCServer
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for LibVNCServer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0196-1 Rating: critical References: #1123823 #1123828 #1123832 Cross-References: CVE-2018-20748 CVE-2018-20749 CVE-2018-20750 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for LibVNCServer fixes the following issues: Security issues fixed: - CVE-2018-20749: Fixed a heap out of bounds write vulnerability in rfbserver.c (bsc#1123828) - CVE-2018-20750: Fixed a heap out of bounds write vulnerability in rfbserver.c (bsc#1123832) - CVE-2018-20748: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1123823) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-196=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): LibVNCServer-debugsource-0.9.10-lp150.3.6.1 LibVNCServer-devel-0.9.10-lp150.3.6.1 libvncclient0-0.9.10-lp150.3.6.1 libvncclient0-debuginfo-0.9.10-lp150.3.6.1 libvncserver0-0.9.10-lp150.3.6.1 libvncserver0-debuginfo-0.9.10-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-20748.html https://www.suse.com/security/cve/CVE-2018-20749.html https://www.suse.com/security/cve/CVE-2018-20750.html https://bugzilla.suse.com/1123823 https://bugzilla.suse.com/1123828 https://bugzilla.suse.com/1123832 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0198-1: moderate: Security update for pspp, spread-sheet-widget
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for pspp, spread-sheet-widget ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0198-1 Rating: moderate References: #1120061 Cross-References: CVE-2018-20230 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pspp to version 1.2.0 fixes the following issues: Security issue fixed: - CVE-2018-20230: Fixed a heap-based buffer overflow in read_bytes_internal function that could lead to denial-of-service (bsc#1120061). Other bug fixes and changes: - Add upstream patch to avoid compiling with old Texinfo 4.13. - New experimental command SAVE DATA COLLECTION to save MDD files. - MTIME and YMDHMS variable formats now supported. - Spread sheet rendering now done via spread-sheet-widget. This update introduces a new package called spread-sheet-widget as dependency. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-198=1 Package List: - openSUSE Leap 15.0 (x86_64): libspread-sheet-widget0-0.3-lp150.2.1 libspread-sheet-widget0-debuginfo-0.3-lp150.2.1 pspp-1.2.0-lp150.2.3.1 pspp-debuginfo-1.2.0-lp150.2.3.1 pspp-debugsource-1.2.0-lp150.2.3.1 pspp-devel-1.2.0-lp150.2.3.1 spread-sheet-widget-debugsource-0.3-lp150.2.1 spread-sheet-widget-devel-0.3-lp150.2.1 References: https://www.suse.com/security/cve/CVE-2018-20230.html https://bugzilla.suse.com/1120061 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0194-1: important: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0194-1 Rating: important References: #1123271 #1123272 Cross-References: CVE-2019-6798 CVE-2019-6799 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for phpMyAdmin to version 4.8.5 fixes the following issues: Security issues fixed: - CVE-2019-6799: Fixed an arbitrary file read vulnerability (boo#1123272) - CVE-2019-6798: Fixed a SQL injection in the designer interface (boo#1123271) Other changes: * Fix rxport to SQL format not available * Fix QR code not shown when adding two-factor authentication to a user account * Fix issue with adding a new user in MySQL 8.0.11 and newer * Fix frozen interface relating to Text_Plain_Sql plugin * Fix missing table level operations tab Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-194=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.8.5-35.1 References: https://www.suse.com/security/cve/CVE-2019-6798.html https://www.suse.com/security/cve/CVE-2019-6799.html https://bugzilla.suse.com/1123271 https://bugzilla.suse.com/1123272 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0189-1: moderate: Security update for docker
by opensuse-security＠opensuse.org 16 Feb '19

16 Feb '19

openSUSE Security Update: Security update for docker ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0189-1 Rating: moderate References: #1001161 #1112980 #1115464 #1118897 #1118898 #1118899 #1118990 #1121412 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has 5 fixes is now available. Description: This update for containerd, docker, docker-runc and golang-github-docker-libnetwork fixes the following issues: Security issues fixed for containerd, docker, docker-runc and golang-github-docker-libnetwork: - CVE-2018-16873: cmd/go: remote command execution during "go get -u" (bsc#1118897) - CVE-2018-16874: cmd/go: directory traversal in "go get" via curly braces in import paths (bsc#1118898) - CVE-2018-16875: crypto/x509: CPU denial of service (bsc#1118899) Non-security issues fixed for docker: - Disable leap based builds for kubic flavor (bsc#1121412) - Allow users to explicitly specify the NIS domainname of a container (bsc#1001161) - Update docker.service to match upstream and avoid rlimit problems (bsc#1112980) - Allow docker images larger then 23GB (bsc#1118990) - Docker version update to version 18.09.0-ce (bsc#1115464) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-189=1 Package List: - openSUSE Leap 15.0 (noarch): containerd-test-1.1.2-lp150.4.6.1 docker-bash-completion-18.09.0_ce-lp150.5.9.1 docker-runc-test-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.6.1 docker-zsh-completion-18.09.0_ce-lp150.5.9.1 - openSUSE Leap 15.0 (x86_64): containerd-1.1.2-lp150.4.6.1 containerd-ctr-1.1.2-lp150.4.6.1 docker-18.09.0_ce-lp150.5.9.1 docker-debuginfo-18.09.0_ce-lp150.5.9.1 docker-debugsource-18.09.0_ce-lp150.5.9.1 docker-libnetwork-0.7.0.1+gitr2704_6da50d197830-lp150.3.6.1 docker-libnetwork-debuginfo-0.7.0.1+gitr2704_6da50d197830-lp150.3.6.1 docker-runc-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.6.1 docker-runc-debuginfo-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.6.1 docker-test-18.09.0_ce-lp150.5.9.1 docker-test-debuginfo-18.09.0_ce-lp150.5.9.1 golang-github-docker-libnetwork-0.7.0.1+gitr2704_6da50d197830-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://bugzilla.suse.com/1001161 https://bugzilla.suse.com/1112980 https://bugzilla.suse.com/1115464 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899 https://bugzilla.suse.com/1118990 https://bugzilla.suse.com/1121412 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0182-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0182-1 Rating: important References: #1122983 Cross-References: CVE-2016-5824 CVE-2018-12405 CVE-2018-17466 CVE-2018-18492 CVE-2018-18493 CVE-2018-18494 CVE-2018-18498 CVE-2018-18500 CVE-2018-18501 CVE-2018-18505 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 60.5.0 fixes the following issues: Security vulnerabilities addressed (MFSA 2019-03 boo#1122983 MFSA 2018-31): - CVE-2018-18500: Use-after-free parsing HTML5 stream - CVE-2018-18505: Privilege escalation through IPC channel messages - CVE-2016-5824: DoS (use-after-free) via a crafted ics file - CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 - CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11 - CVE-2018-18492: Use-after-free with select element - CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia - CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs - CVE-2018-18498: Integer overflow when calculating buffer sizes for images - CVE-2018-12405: Memory safety bugs fixed in Firefox 64, 60.4, and Thunderbird 60.4 Other bugs fixed and changes made: - FileLink provider WeTransfer to upload large attachments - Thunderbird now allows the addition of OpenSearch search engines from a local XML file using a minimal user inferface: [+] button to select a file an add, [-] to remove. - More search engines: Google and DuckDuckGo available by default in some locales - During account creation, Thunderbird will now detect servers using the Microsoft Exchange protocol. It will offer the installation of a 3rd party add-on (Owl) which supports that protocol. - Thunderbird now compatible with other WebExtension-based FileLink add-ons like the Dropbox add-on - New WebExtensions FileLink API to facilitate add-ons - Fix decoding problems for messages with less common charsets (cp932, cp936) - New messages in the drafts folder (and other special or virtual folders) will no longer be included in the new messages notification - Thunderbird 60 will migrate security databases (key3.db, cert8.db to key4.db, cert9.db). Thunderbird 60.3.2 and earlier contained a fault that potentially deleted saved passwords and private certificate keys for users using a master password. Version 60.3.3 will prevent the loss of data; affected users who have already upgraded to version 60.3.2 or earlier can restore the deleted key3.db file from backup to complete the migration. - Address book search and auto-complete slowness introduced in Thunderbird 60.3.2 - Plain text markup with * for bold, / for italics, _ for underline and | for code did not work when the enclosed text contained non-ASCII characters - While composing a message, a link not removed when link location was removed in the link properties panel - Encoding problems when exporting address books or messages using the system charset. Messages are now always exported using the UTF-8 encoding - If the "Date" header of a message was invalid, Jan 1970 or Dec 1969 was displayed. Now using date from "Received" header instead. - Body search/filtering didn't reliably ignore content of tags - Inappropriate warning "Thunderbird prevented the site (addons.thunderbird.net) from asking you to install software on your computer" when installing add-ons - Incorrect display of correspondents column since own email address was not always detected - Spurious 
 (encoded newline) inserted into drafts and sent email - Double-clicking on a word in the Write window sometimes launched the Advanced Property Editor or Link Properties dialog - Fixe Cookie removal - "Download rest of message" was not working if global inbox was used - Fix Encoding problems for users (especially in Poland) when a file was sent via a folder using "Sent to > Mail recipient" due to a problem in the Thunderbird MAPI interface - According to RFC 4616 and RFC 5721, passwords containing non-ASCII characters are encoded using UTF-8 which can lead to problems with non-compliant providers, for example office365.com. The SMTP LOGIN and POP3 USER/PASS authentication methods are now using a Latin-1 encoding again to work around this issue - Fix shutdown crash/hang after entering an empty IMAP password Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-182=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaThunderbird-60.5.0-83.1 MozillaThunderbird-buildsymbols-60.5.0-83.1 MozillaThunderbird-debuginfo-60.5.0-83.1 MozillaThunderbird-debugsource-60.5.0-83.1 MozillaThunderbird-translations-common-60.5.0-83.1 MozillaThunderbird-translations-other-60.5.0-83.1 References: https://www.suse.com/security/cve/CVE-2016-5824.html https://www.suse.com/security/cve/CVE-2018-12405.html https://www.suse.com/security/cve/CVE-2018-17466.html https://www.suse.com/security/cve/CVE-2018-18492.html https://www.suse.com/security/cve/CVE-2018-18493.html https://www.suse.com/security/cve/CVE-2018-18494.html https://www.suse.com/security/cve/CVE-2018-18498.html https://www.suse.com/security/cve/CVE-2018-18500.html https://www.suse.com/security/cve/CVE-2018-18501.html https://www.suse.com/security/cve/CVE-2018-18505.html https://bugzilla.suse.com/1122983 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0183-1: important: Security update for mozilla-nss
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0183-1 Rating: important References: #1119069 Cross-References: CVE-2018-12404 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mozilla-nss fixes the following issues: Security issues fixed: - CVE-2018-12404: Cache side-channel variant of the Bleichenbacher attack (bsc#1119069). Non-security issue fixed: - Update to mozilla-nss 3.41.1 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-183=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libfreebl3-3.41.1-lp150.2.16.1 libfreebl3-debuginfo-3.41.1-lp150.2.16.1 libfreebl3-hmac-3.41.1-lp150.2.16.1 libsoftokn3-3.41.1-lp150.2.16.1 libsoftokn3-debuginfo-3.41.1-lp150.2.16.1 libsoftokn3-hmac-3.41.1-lp150.2.16.1 mozilla-nss-3.41.1-lp150.2.16.1 mozilla-nss-certs-3.41.1-lp150.2.16.1 mozilla-nss-certs-debuginfo-3.41.1-lp150.2.16.1 mozilla-nss-debuginfo-3.41.1-lp150.2.16.1 mozilla-nss-debugsource-3.41.1-lp150.2.16.1 mozilla-nss-devel-3.41.1-lp150.2.16.1 mozilla-nss-sysinit-3.41.1-lp150.2.16.1 mozilla-nss-sysinit-debuginfo-3.41.1-lp150.2.16.1 mozilla-nss-tools-3.41.1-lp150.2.16.1 mozilla-nss-tools-debuginfo-3.41.1-lp150.2.16.1 - openSUSE Leap 15.0 (x86_64): libfreebl3-32bit-3.41.1-lp150.2.16.1 libfreebl3-32bit-debuginfo-3.41.1-lp150.2.16.1 libfreebl3-hmac-32bit-3.41.1-lp150.2.16.1 libsoftokn3-32bit-3.41.1-lp150.2.16.1 libsoftokn3-32bit-debuginfo-3.41.1-lp150.2.16.1 libsoftokn3-hmac-32bit-3.41.1-lp150.2.16.1 mozilla-nss-32bit-3.41.1-lp150.2.16.1 mozilla-nss-32bit-debuginfo-3.41.1-lp150.2.16.1 mozilla-nss-certs-32bit-3.41.1-lp150.2.16.1 mozilla-nss-certs-32bit-debuginfo-3.41.1-lp150.2.16.1 mozilla-nss-sysinit-32bit-3.41.1-lp150.2.16.1 mozilla-nss-sysinit-32bit-debuginfo-3.41.1-lp150.2.16.1 References: https://www.suse.com/security/cve/CVE-2018-12404.html https://bugzilla.suse.com/1119069 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0184-1: moderate: Security update for python
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0184-1 Rating: moderate References: #1122191 Cross-References: CVE-2019-5010 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python fixes the following issues: Security issue fixed: - CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-184=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libpython2_7-1_0-2.7.14-lp150.6.6.1 libpython2_7-1_0-debuginfo-2.7.14-lp150.6.6.1 python-2.7.14-lp150.6.6.1 python-base-2.7.14-lp150.6.6.1 python-base-debuginfo-2.7.14-lp150.6.6.1 python-base-debugsource-2.7.14-lp150.6.6.1 python-curses-2.7.14-lp150.6.6.1 python-curses-debuginfo-2.7.14-lp150.6.6.1 python-debuginfo-2.7.14-lp150.6.6.1 python-debugsource-2.7.14-lp150.6.6.1 python-demo-2.7.14-lp150.6.6.1 python-devel-2.7.14-lp150.6.6.1 python-gdbm-2.7.14-lp150.6.6.1 python-gdbm-debuginfo-2.7.14-lp150.6.6.1 python-idle-2.7.14-lp150.6.6.1 python-tk-2.7.14-lp150.6.6.1 python-tk-debuginfo-2.7.14-lp150.6.6.1 python-xml-2.7.14-lp150.6.6.1 python-xml-debuginfo-2.7.14-lp150.6.6.1 - openSUSE Leap 15.0 (x86_64): libpython2_7-1_0-32bit-2.7.14-lp150.6.6.1 libpython2_7-1_0-32bit-debuginfo-2.7.14-lp150.6.6.1 python-32bit-2.7.14-lp150.6.6.1 python-32bit-debuginfo-2.7.14-lp150.6.6.1 python-base-32bit-2.7.14-lp150.6.6.1 python-base-32bit-debuginfo-2.7.14-lp150.6.6.1 - openSUSE Leap 15.0 (noarch): python-doc-2.7.14-lp150.6.6.1 python-doc-pdf-2.7.14-lp150.6.6.1 References: https://www.suse.com/security/cve/CVE-2019-5010.html https://bugzilla.suse.com/1122191 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0185-1: moderate: Security update for rmt-server
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for rmt-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0185-1 Rating: moderate References: #1102046 #1102193 #1109307 #1113760 #1113969 #1114831 #1117106 #1118579 #1118584 Cross-References: CVE-2018-14404 CVE-2018-16468 CVE-2018-16470 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has 6 fixes is now available. Description: This update for rmt-server to version 1.1.1 fixes the following issues: The following issues have been fixed: - Fixed migration problems which caused some extensions / modules to be dropped (bsc#1118584, bsc#1118579) - Fixed listing of mirrored products (bsc#1102193) - Include online migration paths into offline migration (bsc#1117106) - Sync products that do not have a base product (bsc#1109307) - Fixed SLP auto discovery for RMT (bsc#1113760) Update dependencies for security fixes: - CVE-2018-16468: Update loofah to 2.2.3 (bsc#1113969) - CVE-2018-16470: Update rack to 2.0.6 (bsc#1114831) - CVE-2018-14404: Update nokogiri to 1.8.5 (bsc#1102046) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-185=1 Package List: - openSUSE Leap 15.0 (x86_64): rmt-server-1.1.1-lp150.2.12.1 rmt-server-debuginfo-1.1.1-lp150.2.12.1 rmt-server-pubcloud-1.1.1-lp150.2.12.1 References: https://www.suse.com/security/cve/CVE-2018-14404.html https://www.suse.com/security/cve/CVE-2018-16468.html https://www.suse.com/security/cve/CVE-2018-16470.html https://bugzilla.suse.com/1102046 https://bugzilla.suse.com/1102193 https://bugzilla.suse.com/1109307 https://bugzilla.suse.com/1113760 https://bugzilla.suse.com/1113969 https://bugzilla.suse.com/1114831 https://bugzilla.suse.com/1117106 https://bugzilla.suse.com/1118579 https://bugzilla.suse.com/1118584 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0176-1: important: Security update for spice
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for spice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0176-1 Rating: important References: #1122706 Cross-References: CVE-2019-3813 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for spice fixes the following issues: Security issue fixed: - CVE-2019-3813: Fixed a out-of-bounds read in the memslot_get_virt function that could lead to denial-of-service or code-execution (bsc#1122706). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-176=1 Package List: - openSUSE Leap 42.3 (x86_64): libspice-server-devel-0.12.8-13.1 libspice-server1-0.12.8-13.1 libspice-server1-debuginfo-0.12.8-13.1 spice-debugsource-0.12.8-13.1 References: https://www.suse.com/security/cve/CVE-2019-3813.html https://bugzilla.suse.com/1122706 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0175-1: moderate: Security update for lua53
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for lua53 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0175-1 Rating: moderate References: #1123043 Cross-References: CVE-2019-6706 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lua53 fixes the following issues: Security issue fixed: - CVE-2019-6706: Fixed a use-after-free bug in the lua_upvaluejoin function of lapi.c (bsc#1123043) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-175=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): liblua5_3-5-5.3.4-lp150.2.3.1 liblua5_3-5-debuginfo-5.3.4-lp150.2.3.1 lua53-5.3.4-lp150.2.3.1 lua53-debuginfo-5.3.4-lp150.2.3.1 lua53-debugsource-5.3.4-lp150.2.3.1 lua53-devel-5.3.4-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): lua53-doc-5.3.4-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): liblua5_3-5-32bit-5.3.4-lp150.2.3.1 liblua5_3-5-32bit-debuginfo-5.3.4-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-6706.html https://bugzilla.suse.com/1123043 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0174-1: important: Security update for curl
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0174-1 Rating: important References: #1123371 #1123377 #1123378 Cross-References: CVE-2018-16890 CVE-2019-3822 CVE-2019-3823 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for curl fixes the following issues: Security issues fixed: - CVE-2019-3823: Fixed a heap out-of-bounds read in the code handling the end-of-response for SMTP (bsc#1123378). - CVE-2019-3822: Fixed a stack based buffer overflow in the function creating an outgoing NTLM type-3 message (bsc#1123377). - CVE-2018-16890: Fixed a heap buffer out-of-bounds read in the function handling incoming NTLM type-2 messages (bsc#1123371). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-174=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): curl-7.60.0-lp150.2.18.1 curl-debuginfo-7.60.0-lp150.2.18.1 curl-debugsource-7.60.0-lp150.2.18.1 curl-mini-7.60.0-lp150.2.18.1 curl-mini-debuginfo-7.60.0-lp150.2.18.1 curl-mini-debugsource-7.60.0-lp150.2.18.1 libcurl-devel-7.60.0-lp150.2.18.1 libcurl-mini-devel-7.60.0-lp150.2.18.1 libcurl4-7.60.0-lp150.2.18.1 libcurl4-debuginfo-7.60.0-lp150.2.18.1 libcurl4-mini-7.60.0-lp150.2.18.1 libcurl4-mini-debuginfo-7.60.0-lp150.2.18.1 - openSUSE Leap 15.0 (x86_64): libcurl-devel-32bit-7.60.0-lp150.2.18.1 libcurl4-32bit-7.60.0-lp150.2.18.1 libcurl4-32bit-debuginfo-7.60.0-lp150.2.18.1 References: https://www.suse.com/security/cve/CVE-2018-16890.html https://www.suse.com/security/cve/CVE-2019-3822.html https://www.suse.com/security/cve/CVE-2019-3823.html https://bugzilla.suse.com/1123371 https://bugzilla.suse.com/1123377 https://bugzilla.suse.com/1123378 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0173-1: important: Security update for curl
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0173-1 Rating: important References: #1123371 #1123377 #1123378 Cross-References: CVE-2018-16890 CVE-2019-3822 CVE-2019-3823 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for curl fixes the following issues: Security issues fixed: - CVE-2019-3823: Fixed a heap out-of-bounds read in the code handling the end-of-response for SMTP (bsc#1123378). - CVE-2019-3822: Fixed a stack based buffer overflow in the function creating an outgoing NTLM type-3 message (bsc#1123377). - CVE-2018-16890: Fixed a heap buffer out-of-bounds read in the function handling incoming NTLM type-2 messages (bsc#1123371). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-173=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): curl-7.37.0-45.1 curl-debuginfo-7.37.0-45.1 curl-debugsource-7.37.0-45.1 libcurl-devel-7.37.0-45.1 libcurl4-7.37.0-45.1 libcurl4-debuginfo-7.37.0-45.1 - openSUSE Leap 42.3 (x86_64): libcurl-devel-32bit-7.37.0-45.1 libcurl4-32bit-7.37.0-45.1 libcurl4-debuginfo-32bit-7.37.0-45.1 References: https://www.suse.com/security/cve/CVE-2018-16890.html https://www.suse.com/security/cve/CVE-2019-3822.html https://www.suse.com/security/cve/CVE-2019-3823.html https://bugzilla.suse.com/1123371 https://bugzilla.suse.com/1123377 https://bugzilla.suse.com/1123378 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0171-1: Security update for uriparser
by opensuse-security＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Security Update: Security update for uriparser ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0171-1 Rating: low References: #1115722 #1115723 #1115724 #1122193 Cross-References: CVE-2018-19198 CVE-2018-19199 CVE-2018-19200 CVE-2018-20721 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for uriparser fixes the following issues: Security issues fixed: - CVE-2018-20721: Fixed an out-of-bounds read for incomplete URIs with IPv6 addresses with embedded IPv4 address (bsc#1122193). - CVE-2018-19198: Fixed an out-of-bounds write that was possible via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115722). - CVE-2018-19199: Fixed an integer overflow caused by an unchecked multiplication via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115723). - CVE-2018-19200: Fixed a operation attempted on NULL input via a uriResetUri* function (bsc#1115724). This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-171=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): liburiparser1-0.8.5-bp150.2.3.1 uriparser-0.8.5-bp150.2.3.1 uriparser-devel-0.8.5-bp150.2.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): liburiparser1-64bit-0.8.5-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-19198.html https://www.suse.com/security/cve/CVE-2018-19199.html https://www.suse.com/security/cve/CVE-2018-19200.html https://www.suse.com/security/cve/CVE-2018-20721.html https://bugzilla.suse.com/1115722 https://bugzilla.suse.com/1115723 https://bugzilla.suse.com/1115724 https://bugzilla.suse.com/1122193 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0169-1: Security update for python-slixmpp
by opensuse-security＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Security Update: Security update for python-slixmpp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0169-1 Rating: low References: #1124322 Cross-References: CVE-2019-1000021 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-slixmpp fixes the following issue: Security issue fixed: - CVE-2019-1000021: Fixed incorrect Access Control vulnerability in XEP-0223 plugin (bsc#1124322) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-169=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): python3-slixmpp-1.3.0-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-1000021.html https://bugzilla.suse.com/1124322 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0170-1: important: Security update for runc
by opensuse-security＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Security Update: Security update for runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0170-1 Rating: important References: #1095817 #1118897 #1118898 #1118899 #1121967 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 CVE-2019-5736 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for runc fixes the following issues: Security vulnerabilities addressed: - CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967) - CVE-2018-16873: Fix a remote command execution during "go get -u" (boo#1118897) - CVE-2018-16874: Fix a directory traversal in "go get" via curly braces in import paths (boo#1118898) - CVE-2018-16875: Fix a CPU denial of service issue (boo#1118899) Other changes and bug fixes: - Update go requirements to >= go1.10 - Create a symlink in /usr/bin/runc to enable rootless Podman and Buildah. - Make use of %license macro - Remove 'go test' from %check section, as it has only ever caused us problems and hasn't (as far as I remember) ever caught a release-blocking issue. Smoke testing has been far more useful. (boo#1095817) - Upgrade to runc v1.0.0~rc6. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc6 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-170=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): runc-1.0.0~rc6-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): runc-test-1.0.0~rc6-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://www.suse.com/security/cve/CVE-2019-5736.html https://bugzilla.suse.com/1095817 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899 https://bugzilla.suse.com/1121967 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0166-1: important: Security update for haproxy
by opensuse-security＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Security Update: Security update for haproxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0166-1 Rating: important References: #1121283 Cross-References: CVE-2018-20615 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for haproxy version 1.8.17 fixes the following issues: Security issues fixed: - CVE-2018-20615: Fixed a denial of service, triggered by mishandling the priority flag on short HEADERS frame in the HTTP/2 decoder (bsc#1121283) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-166=1 Package List: - openSUSE Leap 15.0 (x86_64): haproxy-1.8.17~git0.e89d25b2-lp150.2.9.1 haproxy-debuginfo-1.8.17~git0.e89d25b2-lp150.2.9.1 haproxy-debugsource-1.8.17~git0.e89d25b2-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-20615.html https://bugzilla.suse.com/1121283 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0167-1: important: Security update for spice
by opensuse-security＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Security Update: Security update for spice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0167-1 Rating: important References: #1109044 #1122706 Cross-References: CVE-2019-3813 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for spice fixes the following issues: Security issue fixed: - CVE-2019-3813: Fixed a out-of-bounds read in the memslot_get_virt function that could lead to denial-of-service or code-execution (bsc#1122706). Non-security issue fixed: - Include spice-server tweak to compensate for performance issues with Windows guests (bsc#1109044). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-167=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libspice-server-devel-0.14.0-lp150.3.6.1 libspice-server1-0.14.0-lp150.3.6.1 libspice-server1-debuginfo-0.14.0-lp150.3.6.1 spice-debugsource-0.14.0-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-3813.html https://bugzilla.suse.com/1109044 https://bugzilla.suse.com/1122706 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0165-1: Security update for uriparser
by opensuse-security＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Security Update: Security update for uriparser ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0165-1 Rating: low References: #1115722 #1115723 #1115724 #1122193 Cross-References: CVE-2018-19198 CVE-2018-19199 CVE-2018-19200 CVE-2018-20721 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for uriparser fixes the following issues: Security issues fixed: - CVE-2018-20721: Fixed an out-of-bounds read for incomplete URIs with IPv6 addresses with embedded IPv4 address (bsc#1122193). - CVE-2018-19198: Fixed an out-of-bounds write that was possible via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115722). - CVE-2018-19199: Fixed an integer overflow caused by an unchecked multiplication via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115723). - CVE-2018-19200: Fixed a operation attempted on NULL input via a uriResetUri* function (bsc#1115724). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-165=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): liburiparser1-0.8.5-lp150.2.3.1 liburiparser1-debuginfo-0.8.5-lp150.2.3.1 uriparser-0.8.5-lp150.2.3.1 uriparser-debuginfo-0.8.5-lp150.2.3.1 uriparser-debugsource-0.8.5-lp150.2.3.1 uriparser-devel-0.8.5-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): liburiparser1-32bit-0.8.5-lp150.2.3.1 liburiparser1-32bit-debuginfo-0.8.5-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-19198.html https://www.suse.com/security/cve/CVE-2018-19199.html https://www.suse.com/security/cve/CVE-2018-19200.html https://www.suse.com/security/cve/CVE-2018-20721.html https://bugzilla.suse.com/1115722 https://bugzilla.suse.com/1115723 https://bugzilla.suse.com/1115724 https://bugzilla.suse.com/1122193 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0163-1: Security update for python-slixmpp
by opensuse-security＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Security Update: Security update for python-slixmpp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0163-1 Rating: low References: #1124322 Cross-References: CVE-2019-1000021 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-slixmpp fixes the following issue: Security issue fixed: - CVE-2019-1000021: Fixed incorrect Access Control vulnerability in XEP-0223 plugin (bsc#1124322) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-163=1 Package List: - openSUSE Leap 15.0 (x86_64): python-slixmpp-debugsource-1.3.0-lp150.2.3.1 python3-slixmpp-1.3.0-lp150.2.3.1 python3-slixmpp-debuginfo-1.3.0-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-1000021.html https://bugzilla.suse.com/1124322 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0159-1: moderate: Security update for python-urllib3
by opensuse-security＠opensuse.org 12 Feb '19

12 Feb '19

openSUSE Security Update: Security update for python-urllib3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0159-1 Rating: moderate References: #1024540 #1074247 #1110422 Cross-References: CVE-2016-9015 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for python-urllib3 fixes the following issues: python-urllib3 was updated to version 1.22 (fate#326733, bsc#1110422) and contains new features and lots of bugfixes: The full changelog can be found on: https://github.com/Lukasa/urllib3/blob/1.22/CHANGES.rst Security issues fixed: - CVE-2016-9015: TLS certificate validation vulnerability (bsc#1024540). (This issue did not affect our previous version 1.16.) Non security issues fixed: - bsc#1074247: Fix test suite, use correct date (gh#shazow/urllib3#1303). This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-159=1 Package List: - openSUSE Leap 42.3 (noarch): python-urllib3-1.22-4.4.1 python3-urllib3-1.22-4.4.1 References: https://www.suse.com/security/cve/CVE-2016-9015.html https://bugzilla.suse.com/1024540 https://bugzilla.suse.com/1074247 https://bugzilla.suse.com/1110422 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0161-1: important: Security update for java-11-openjdk
by opensuse-security＠opensuse.org 12 Feb '19

12 Feb '19

openSUSE Security Update: Security update for java-11-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0161-1 Rating: important References: #1120431 #1122293 #1122299 Cross-References: CVE-2018-11212 CVE-2019-2422 CVE-2019-2426 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for java-11-openjdk to version 11.0.2+7 fixes the following issues: Security issues fixed: - CVE-2019-2422: Better FileChannel transfer performance (bsc#1122293) - CVE-2019-2426: Improve web server connections - CVE-2018-11212: Improve JPEG processing (bsc#1122299) - Better route routing - Better interface enumeration - Better interface lists - Improve BigDecimal support - Improve robot support - Better icon support - Choose printer defaults - Proper allocation handling - Initial class initialization - More reliable p11 transactions - Improve NIO stability - Better loading of classloader classes - Strengthen Windows Access Bridge Support - Improved data set handling - Improved LSA authentication - Libsunmscapi improved interactions Non-security issues fix: - Do not resolve by default the added JavaEE modules (bsc#1120431) - ~2.5% regression on compression benchmark starting with 12-b11 - java.net.http.HttpClient hangs on 204 reply without Content-length 0 - Add additional TeliaSonera root certificate - Add more ld preloading related info to hs_error file on Linux - Add test to exercise server-side client hello processing - AES encrypt performance regression in jdk11b11 - AIX: ProcessBuilder: Piping between created processes does not work. - AIX: Some class library files are missing the Classpath exception - AppCDS crashes for some uses with JRuby - Automate vtable/itable stub size calculation - BarrierSetC1::generate_referent_check() confuses register allocator - Better HTTP Redirection - Catastrophic size_t underflow in BitMap::*_large methods - Clip.isRunning() may return true after Clip.stop() was called - Compiler thread creation should be bounded by available space in memory and Code Cache - com.sun.net.httpserver.HttpServer returns Content-length header for 204 response code - Default mask register for avx512 instructions - Delayed starting of debugging via jcmd - Disable all DES cipher suites - Disable anon and NULL cipher suites - Disable unsupported GCs for Zero - Epsilon alignment adjustments can overflow max TLAB size - Epsilon elastic TLAB sizing may cause misalignment - HotSpot update for vm_version.cpp to recognise updated VS2017 - HttpClient does not retrieve files with large sizes over HTTP/1.1 - IIOException "tEXt chunk length is not proper" on opening png file - Improve TLS connection stability again - InitialDirContext ctor sometimes throws NPE if the server has sent a disconnection - Inspect stack during error reporting - Instead of circle rendered in appl window, but ellipse is produced JEditor Pane - Introduce diagnostic flag to abort VM on failed JIT compilation - Invalid assert(HeapBaseMinAddress > 0) in ReservedHeapSpace::initialize_compressed_heap - jar has issues with UNC-path arguments for the jar -C parameter [windows] - java.net.http HTTP client should allow specifying Origin and Referer headers - java.nio.file.Files.writeString writes garbled UTF-16 instead of UTF-8 - JDK 11.0.1 l10n resource file update - JDWP Transport Listener: dt_socket thread crash - JVMTI ResourceExhausted should not be posted in CompilerThread - LDAPS communication failure with jdk 1.8.0_181 - linux: Poor StrictMath performance due to non-optimized compilation - Missing synchronization when reading counters for live threads and peak thread count - NPE in SupportedGroupsExtension - OpenDataException thrown when constructing CompositeData for StackTraceElement - Parent class loader may not have a referred ClassLoaderData instance when obtained in Klass::class_in_module_of_loader - Populate handlers while holding streamHandlerLock - ppc64: Enable POWER9 CPU detection - print_location is not reliable enough (printing register info) - Reconsider default option for ClassPathURLCheck change done in JDK-8195874 - Register to register spill may use AVX 512 move instruction on unsupported platform. - s390: Use of shift operators not covered by cpp standard - serviceability/sa/TestUniverse.java#id0 intermittently fails with assert(get_instanceKlass()->is_loaded()) failed: must be at least loaded - SIGBUS in CodeHeapState::print_names() - SIGSEGV in MethodArityHistogram() with -XX:+CountCompiledCalls - Soft reference reclamation race in com.sun.xml.internal.stream.util.ThreadLocalBufferAllocator - Swing apps are slow if displaying from a remote source to many local displays - switch jtreg to 4.2b13 - Test library OSInfo.getSolarisVersion cannot determine Solaris version - TestOptionsWithRanges.java is very slow - TestOptionsWithRanges.java of '-XX:TLABSize=2147483648' fails intermittently - The Japanese message of FileNotFoundException garbled - The "supported_groups" extension in ServerHellos - ThreadInfoCompositeData.toCompositeData fails to map ThreadInfo to CompositeData - TimeZone.getDisplayName given Locale.US doesn't always honor the Locale. - TLS 1.2 Support algorithm in SunPKCS11 provider - TLS 1.3 handshake server name indication is missing on a session resume - TLS 1.3 server fails if ClientHello doesn't have pre_shared_key and psk_key_exchange_modes - TLS 1.3 interop problems with OpenSSL 1.1.1 when used on the client side with mutual auth - tz: Upgrade time-zone data to tzdata2018g - Undefined behaviour in ADLC - Update avx512 implementation - URLStreamHandler initialization race - UseCompressedOops requirement check fails fails on 32-bit system - windows: Update OS detection code to recognize Windows Server 2019 - x86: assert on unbound assembler Labels used as branch targets - x86: jck tests for ldc2_w bytecode fail - x86: sharedRuntimeTrig/sharedRuntimeTrans compiled without optimization - "-XX:OnOutOfMemoryError" uses fork instead of vfork This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-161=1 Package List: - openSUSE Leap 15.0 (x86_64): java-11-openjdk-11.0.2.0-lp150.2.12.1 java-11-openjdk-accessibility-11.0.2.0-lp150.2.12.1 java-11-openjdk-accessibility-debuginfo-11.0.2.0-lp150.2.12.1 java-11-openjdk-debuginfo-11.0.2.0-lp150.2.12.1 java-11-openjdk-debugsource-11.0.2.0-lp150.2.12.1 java-11-openjdk-demo-11.0.2.0-lp150.2.12.1 java-11-openjdk-devel-11.0.2.0-lp150.2.12.1 java-11-openjdk-headless-11.0.2.0-lp150.2.12.1 java-11-openjdk-jmods-11.0.2.0-lp150.2.12.1 java-11-openjdk-src-11.0.2.0-lp150.2.12.1 - openSUSE Leap 15.0 (noarch): java-11-openjdk-javadoc-11.0.2.0-lp150.2.12.1 References: https://www.suse.com/security/cve/CVE-2018-11212.html https://www.suse.com/security/cve/CVE-2019-2422.html https://www.suse.com/security/cve/CVE-2019-2426.html https://bugzilla.suse.com/1120431 https://bugzilla.suse.com/1122293 https://bugzilla.suse.com/1122299 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0155-1: important: Security update for python3
by opensuse-security＠opensuse.org 08 Feb '19

08 Feb '19

openSUSE Security Update: Security update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0155-1 Rating: important References: #1120644 #1122191 Cross-References: CVE-2018-20406 CVE-2019-5010 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python3 fixes the following issues: Security issue fixed: - CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191) - CVE-2018-20406: Fixed a integer overflow via a large LONG_BINPUT (bsc#1120644) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-155=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libpython3_6m1_0-3.6.5-lp150.2.6.1 libpython3_6m1_0-debuginfo-3.6.5-lp150.2.6.1 python3-3.6.5-lp150.2.6.1 python3-base-3.6.5-lp150.2.6.1 python3-base-debuginfo-3.6.5-lp150.2.6.1 python3-base-debugsource-3.6.5-lp150.2.6.1 python3-curses-3.6.5-lp150.2.6.1 python3-curses-debuginfo-3.6.5-lp150.2.6.1 python3-dbm-3.6.5-lp150.2.6.1 python3-dbm-debuginfo-3.6.5-lp150.2.6.1 python3-debuginfo-3.6.5-lp150.2.6.1 python3-debugsource-3.6.5-lp150.2.6.1 python3-devel-3.6.5-lp150.2.6.1 python3-devel-debuginfo-3.6.5-lp150.2.6.1 python3-idle-3.6.5-lp150.2.6.1 python3-testsuite-3.6.5-lp150.2.6.1 python3-testsuite-debuginfo-3.6.5-lp150.2.6.1 python3-tk-3.6.5-lp150.2.6.1 python3-tk-debuginfo-3.6.5-lp150.2.6.1 python3-tools-3.6.5-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libpython3_6m1_0-32bit-3.6.5-lp150.2.6.1 libpython3_6m1_0-32bit-debuginfo-3.6.5-lp150.2.6.1 python3-32bit-3.6.5-lp150.2.6.1 python3-32bit-debuginfo-3.6.5-lp150.2.6.1 python3-base-32bit-3.6.5-lp150.2.6.1 python3-base-32bit-debuginfo-3.6.5-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): python3-doc-3.6.5-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-20406.html https://www.suse.com/security/cve/CVE-2019-5010.html https://bugzilla.suse.com/1120644 https://bugzilla.suse.com/1122191 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0154-1: important: Security update for rsyslog
by opensuse-security＠opensuse.org 08 Feb '19

08 Feb '19

openSUSE Security Update: Security update for rsyslog ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0154-1 Rating: important References: #1123164 Cross-References: CVE-2018-16881 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rsyslog fixes the following issues: Security issue fixed: - CVE-2018-16881: Fixed a denial of service when both the imtcp module and Octet-Counted TCP Framing is enabled (bsc#1123164). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-154=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): rsyslog-8.24.0-2.10.1 rsyslog-debuginfo-8.24.0-2.10.1 rsyslog-debugsource-8.24.0-2.10.1 rsyslog-diag-tools-8.24.0-2.10.1 rsyslog-diag-tools-debuginfo-8.24.0-2.10.1 rsyslog-doc-8.24.0-2.10.1 rsyslog-module-dbi-8.24.0-2.10.1 rsyslog-module-dbi-debuginfo-8.24.0-2.10.1 rsyslog-module-elasticsearch-8.24.0-2.10.1 rsyslog-module-elasticsearch-debuginfo-8.24.0-2.10.1 rsyslog-module-gcrypt-8.24.0-2.10.1 rsyslog-module-gcrypt-debuginfo-8.24.0-2.10.1 rsyslog-module-gssapi-8.24.0-2.10.1 rsyslog-module-gssapi-debuginfo-8.24.0-2.10.1 rsyslog-module-gtls-8.24.0-2.10.1 rsyslog-module-gtls-debuginfo-8.24.0-2.10.1 rsyslog-module-guardtime-8.24.0-2.10.1 rsyslog-module-guardtime-debuginfo-8.24.0-2.10.1 rsyslog-module-mmnormalize-8.24.0-2.10.1 rsyslog-module-mmnormalize-debuginfo-8.24.0-2.10.1 rsyslog-module-mysql-8.24.0-2.10.1 rsyslog-module-mysql-debuginfo-8.24.0-2.10.1 rsyslog-module-omamqp1-8.24.0-2.10.1 rsyslog-module-omamqp1-debuginfo-8.24.0-2.10.1 rsyslog-module-omhttpfs-8.24.0-2.10.1 rsyslog-module-omhttpfs-debuginfo-8.24.0-2.10.1 rsyslog-module-omtcl-8.24.0-2.10.1 rsyslog-module-omtcl-debuginfo-8.24.0-2.10.1 rsyslog-module-pgsql-8.24.0-2.10.1 rsyslog-module-pgsql-debuginfo-8.24.0-2.10.1 rsyslog-module-relp-8.24.0-2.10.1 rsyslog-module-relp-debuginfo-8.24.0-2.10.1 rsyslog-module-snmp-8.24.0-2.10.1 rsyslog-module-snmp-debuginfo-8.24.0-2.10.1 rsyslog-module-udpspoof-8.24.0-2.10.1 rsyslog-module-udpspoof-debuginfo-8.24.0-2.10.1 References: https://www.suse.com/security/cve/CVE-2018-16881.html https://bugzilla.suse.com/1123164 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0153-1: moderate: Security update for subversion
by opensuse-security＠opensuse.org 08 Feb '19

08 Feb '19

openSUSE Security Update: Security update for subversion ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0153-1 Rating: moderate References: #1122842 Cross-References: CVE-2018-11803 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for subversion fixes the following issues: Security issue fixed: - CVE-2018-11803: Fixed a vulnerability that allowed malicious SVN clients to trigger a crash in mod_dav_svn by omitting the root path from a recursive directory listing request (bsc#1122842) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-153=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.10.0-lp150.2.3.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.10.0-lp150.2.3.1 libsvn_auth_kwallet-1-0-1.10.0-lp150.2.3.1 libsvn_auth_kwallet-1-0-debuginfo-1.10.0-lp150.2.3.1 subversion-1.10.0-lp150.2.3.1 subversion-debuginfo-1.10.0-lp150.2.3.1 subversion-debugsource-1.10.0-lp150.2.3.1 subversion-devel-1.10.0-lp150.2.3.1 subversion-perl-1.10.0-lp150.2.3.1 subversion-perl-debuginfo-1.10.0-lp150.2.3.1 subversion-python-1.10.0-lp150.2.3.1 subversion-python-ctypes-1.10.0-lp150.2.3.1 subversion-python-debuginfo-1.10.0-lp150.2.3.1 subversion-ruby-1.10.0-lp150.2.3.1 subversion-ruby-debuginfo-1.10.0-lp150.2.3.1 subversion-server-1.10.0-lp150.2.3.1 subversion-server-debuginfo-1.10.0-lp150.2.3.1 subversion-tools-1.10.0-lp150.2.3.1 subversion-tools-debuginfo-1.10.0-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): subversion-bash-completion-1.10.0-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-11803.html https://bugzilla.suse.com/1122842 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0152-1: moderate: Security update for openssl-1_1
by opensuse-security＠opensuse.org 08 Feb '19

08 Feb '19

openSUSE Security Update: Security update for openssl-1_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0152-1 Rating: moderate References: #1117951 #1118913 Cross-References: CVE-2018-0737 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for openssl-1_1 fixes the following issues: Security issues fixed: - The 9 Lives of Bleichenbacher's CAT: Cache Attacks on TLS Implementations (bsc#1117951) - Fix FIPS RSA generator (bsc#1118913) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-152=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libopenssl-1_1-devel-1.1.0i-lp150.3.18.1 libopenssl1_1-1.1.0i-lp150.3.18.1 libopenssl1_1-debuginfo-1.1.0i-lp150.3.18.1 libopenssl1_1-hmac-1.1.0i-lp150.3.18.1 openssl-1_1-1.1.0i-lp150.3.18.1 openssl-1_1-debuginfo-1.1.0i-lp150.3.18.1 openssl-1_1-debugsource-1.1.0i-lp150.3.18.1 - openSUSE Leap 15.0 (noarch): openssl-1_1-doc-1.1.0i-lp150.3.18.1 - openSUSE Leap 15.0 (x86_64): libopenssl-1_1-devel-32bit-1.1.0i-lp150.3.18.1 libopenssl1_1-32bit-1.1.0i-lp150.3.18.1 libopenssl1_1-32bit-debuginfo-1.1.0i-lp150.3.18.1 libopenssl1_1-hmac-32bit-1.1.0i-lp150.3.18.1 References: https://www.suse.com/security/cve/CVE-2018-0737.html https://bugzilla.suse.com/1117951 https://bugzilla.suse.com/1118913 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0143-1: important: Security update for python-python-gnupg
by opensuse-security＠opensuse.org 07 Feb '19

07 Feb '19

openSUSE Security Update: Security update for python-python-gnupg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0143-1 Rating: important References: #1123498 Cross-References: CVE-2019-6690 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-python-gnupg to version 0.4.4 fixes the following issues: Security issue fixed: - CVE-2019-6690: Added a check to disallow certain control characters ('\r', '\n', NUL) in passphrases (boo#1123498). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-143=1 Package List: - openSUSE Leap 15.0 (noarch): python2-python-gnupg-0.4.4-lp150.2.6.1 python3-python-gnupg-0.4.4-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-6690.html https://bugzilla.suse.com/1123498 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0140-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 06 Feb '19

06 Feb '19

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0140-1 Rating: important References: #1012382 #1015336 #1015337 #1015340 #1019683 #1019695 #1020645 #1023175 #1027260 #1031492 #1043083 #1047487 #1065600 #1068032 #1070805 #1079935 #1086423 #1087082 #1091405 #1094244 #1094823 #1096242 #1096281 #1099523 #1100105 #1101557 #1102660 #1102875 #1102877 #1102879 #1102882 #1102896 #1103156 #1103257 #1104098 #1106105 #1106929 #1107866 #1108240 #1109272 #1109665 #1109695 #1110286 #1114417 #1114648 #1114763 #1114871 #1114893 #1115431 #1116027 #1116183 #1116336 #1116345 #1116653 #1116841 #1116962 #1117162 #1117165 #1117186 #1118152 #1118316 #1118319 #1118505 #1118790 #1118798 #1118915 #1118922 #1118926 #1118930 #1118936 #1119204 #1119680 #1119714 #1119877 #1119946 #1119967 #1119970 #1120046 #1120722 #1120743 #1120758 #1120902 #1120950 #1121239 #1121240 #1121241 #1121242 #1121275 #1121621 #1121726 #1122650 #1122651 #1122885 #1123321 #1123323 #1123357 Cross-References: CVE-2018-1120 CVE-2018-16862 CVE-2018-16884 CVE-2018-19407 CVE-2018-19824 CVE-2018-19985 CVE-2018-20169 CVE-2018-9568 CVE-2019-3459 CVE-2019-3460 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has 86 fixes is now available. Description: The openSUSE Leap 42.3 Linux kernel was updated to 4.4.172 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2019-3459,CVE-2019-3460: Two remote information leak vulnerabilities in the Bluetooth stack were fixed that could potentially leak kernel information (bsc#1120758) - CVE-2018-19407: The vcpu_scan_ioapic function in arch/x86/kvm/x86.c allowed local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized (bnc#1116841). - CVE-2018-19985: The function hso_probe read if_num from the USB device (as an u8) and used it without a length check to index an array, resulting in an OOB memory read in hso_probe or hso _get_config_data that could be used by local attackers (bnc#1120743). - CVE-2018-1120: By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which made a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks) (bnc#1087082). - CVE-2018-16884: NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out (bnc#1119946). - CVE-2018-20169: The USB subsystem mishandled size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c (bnc#1119714). - CVE-2018-9568: In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. (bnc#1118319). - CVE-2018-16862: A security flaw was found in a way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one (bnc#1117186). - CVE-2018-19824: A local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c (bnc#1118152). The following non-security bugs were fixed: - 9p/net: put a lower bound on msize (bnc#1012382). - ACPI/IORT: Fix iort_get_platform_device_domain() uninitialized pointer value (bsc#1121239). - acpi/nfit: Block function zero DSMs (bsc#1123321). - acpi/nfit: Fix command-supported detection (bsc#1123323). - acpi/nfit, x86/mce: Handle only uncorrectable machine checks (bsc#1114648). - acpi/nfit, x86/mce: Validate a MCE's address before using it (bsc#1114648). - acpi/power: Skip duplicate power resource references in _PRx (bnc#1012382). - acpi/processor: Fix the return value of acpi_processor_ids_walk() (git fixes (acpi)). - aio: fix spectre gadget in lookup_ioctx (bnc#1012382). - aio: hold an extra file reference over AIO read/write operations (bsc#1116027). - alsa: ac97: Fix incorrect bit shift at AC97-SPSA control write (bnc#1012382). - alsa: bebob: fix model-id of unit for Apogee Ensemble (bnc#1012382). - alsa: control: Fix race between adding and removing a user element (bnc#1012382). - alsa: cs46xx: Potential NULL dereference in probe (bnc#1012382). - alsa: emu10k1: Fix potential Spectre v1 vulnerabilities (bnc#1012382). - alsa: emux: Fix potential Spectre v1 vulnerabilities (bnc#1012382). - alsa: hda: add mute LED support for HP EliteBook 840 G4 (bnc#1012382). - alsa: hda: Add support for AMD Stoney Ridge (bnc#1012382). - alsa: hda/realtek - Disable headset Mic VREF for headset mode of ALC225 (bnc#1012382). - alsa: hda/tegra: clear pending irq handlers (bnc#1012382). - alsa: isa/wavefront: prevent some out of bound writes (bnc#1012382). - alsa: pcm: Call snd_pcm_unlink() conditionally at closing (bnc#1012382). - alsa: pcm: Fix interval evaluation with openmin/max (bnc#1012382). - alsa: pcm: Fix potential Spectre v1 vulnerability (bnc#1012382). - alsa: pcm: Fix starvation on down_write_nonblock() (bnc#1012382). - alsa: pcm: remove SNDRV_PCM_IOCTL1_INFO internal command (bnc#1012382). - alsa: rme9652: Fix potential Spectre v1 vulnerability (bnc#1012382). - alsa: sparc: Fix invalid snd_free_pages() at error path (bnc#1012382). - alsa: trident: Suppress gcc string warning (bnc#1012382). - alsa: usb-audio: Avoid access before bLength check in build_audio_procunit() (bnc#1012382). - alsa: usb-audio: Fix an out-of-bound read in create_composite_quirks (bnc#1012382). - alsa: wss: Fix invalid snd_free_pages() at error path (bnc#1012382). - arc: change defconfig defaults to ARCv2 (bnc#1012382). - arc: [devboards] Add support of NFSv3 ACL (bnc#1012382). - arc: io.h: Implement reads{x}()/writes{x}() (bnc#1012382). - arm64: Do not trap host pointer auth use to EL2 (bnc#1012382). - arm64/kvm: consistently handle host HCR_EL2 flags (bnc#1012382). - arm64: perf: set suppress_bind_attrs flag to true (bnc#1012382). - arm64: remove no-op -p linker flag (bnc#1012382). - arm: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling (bnc#1012382). - arm: imx: update the cpu power up timing setting on i.mx6sx (bnc#1012382). - arm: kvm: fix building with gcc-8 (bsc#1121241). - arm: OMAP1: ams-delta: Fix possible use of uninitialized field (bnc#1012382). - arm: OMAP2+: prm44xx: Fix section annotation on omap44xx_prm_enable_io_wakeup (bnc#1012382). - ASoC: dapm: Recalculate audio map forcely when card instantiated (bnc#1012382). - ASoC: omap-dmic: Add pm_qos handling to avoid overruns with CPU_IDLE (bnc#1012382). - ASoC: omap-mcpdm: Add pm_qos handling to avoid under/overruns with CPU_IDLE (bnc#1012382). - ata: Fix racy link clearance (bsc#1107866). - ath10k: fix kernel panic due to race in accessing arvif list (bnc#1012382). - ax25: fix a use-after-free in ax25_fillin_cb() (bnc#1012382). - b43: Fix error in cordic routine (bnc#1012382). - batman-adv: Expand merged fragment buffer for full packet (bnc#1012382). - bfs: add sanity check at bfs_fill_super() (bnc#1012382). - block/loop: Use global lock for ioctl() operation (bnc#1012382). - block/swim3: Fix -EBUSY error when re-opening device after unmount (Git-fixes). - bnx2x: Assign unique DMAE channel number for FW DMAE transactions (bnc#1012382). - bonding: fix 802.3ad state sent to partner when unbinding slave (bnc#1012382). - bpf: fix check of allowed specifiers in bpf_trace_printk (bnc#1012382). - bpf: support 8-byte metafield access (bnc#1012382). - bpf, trace: check event type in bpf_perf_event_read (bsc#1119970). - bpf, trace: use READ_ONCE for retrieving file ptr (bsc#1119967). - bpf/verifier: Add spi variable to check_stack_write() (bnc#1012382). - bpf/verifier: Pass instruction index to check_mem_access() and check_xadd() (bnc#1012382). - btrfs: Always try all copies when reading extent buffers (bnc#1012382). - btrfs: ensure path name is null terminated at btrfs_control_ioctl (bnc#1012382). - btrfs: Fix memory barriers usage with device stats counters (git-fixes). - btrfs: fix use-after-free when dumping free space (bnc#1012382). - btrfs: Handle error from btrfs_uuid_tree_rem call in _btrfs_ioctl_set_received_subvol (git-fixes). - btrfs: release metadata before running delayed refs (bnc#1012382). - btrfs: send, fix infinite loop due to directory rename dependencies (bnc#1012382). - btrfs: tree-checker: Check level for leaves and nodes (bnc#1012382). - btrfs: tree-checker: Do not check max block group size as current max chunk size limit is unreliable (fixes for bnc#1012382 bsc#1102875 bsc#1102877 bsc#1102879 bsc#1102882 bsc#1102896). - btrfs: tree-checker: Fix misleading group system information (bnc#1012382). - btrfs: tree-check: reduce stack consumption in check_dir_item (bnc#1012382). - btrfs: validate type when reading a chunk (bnc#1012382). - btrfs: wait on ordered extents on abort cleanup (bnc#1012382). - can: dev: __can_get_echo_skb(): Do not crash the kernel if can_priv::echo_skb is accessed out of bounds (bnc#1012382). - can: dev: can_get_echo_skb(): factor out non sending code to __can_get_echo_skb() (bnc#1012382). - can: dev: __can_get_echo_skb(): print error message, if trying to echo non existing skb (bnc#1012382). - can: dev: __can_get_echo_skb(): replace struct can_frame by canfd_frame to access frame length (bnc#1012382). - can: gw: ensure DLC boundaries after CAN frame modification (bnc#1012382). - can: rcar_can: Fix erroneous registration (bnc#1012382). - cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader (bnc#1012382). - ceph: do not update importing cap's mseq when handing cap export (bsc#1121275). - checkstack.pl: fix for aarch64 (bnc#1012382). - cifs: Do not hide EINTR after sending network packets (bnc#1012382). - cifs: Fix error mapping for SMB2_LOCK command which caused OFD lock problem (bnc#1012382). - cifs: Fix potential OOB access of lock element array (bnc#1012382). - cifs: Fix separator when building path from dentry (bnc#1012382). - cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs) (bnc#1012382). - clk: imx6q: reset exclusive gates on init (bnc#1012382). - clk: mmp: Off by one in mmp_clk_add() (bnc#1012382). - cpufeature: avoid warning when compiling with clang (Git-fixes). - cpufreq: imx6q: add return value check for voltage scale (bnc#1012382). - crypto: authencesn - Avoid twice completion call in decrypt path (bnc#1012382). - crypto: authenc - fix parsing key with misaligned rta_len (bnc#1012382). - crypto: cts - fix crash on short inputs (bnc#1012382). - crypto: user - support incremental algorithm dumps (bsc#1120902). - crypto: x86/chacha20 - avoid sleeping with preemption disabled (bnc#1012382). - cw1200: Do not leak memory if krealloc failes (bnc#1012382). - debugobjects: avoid recursive calls with kmemleak (bnc#1012382). - Disable MSI also when pcie-octeon.pcie_disable on (bnc#1012382). - disable stringop truncation warnings for now (bnc#1012382). - dlm: fixed memory leaks after failed ls_remove_names allocation (bnc#1012382). - dlm: lost put_lkb on error path in receive_convert() and receive_unlock() (bnc#1012382). - dlm: memory leaks on error path in dlm_user_request() (bnc#1012382). - dlm: possible memory leak on error path in create_lkb() (bnc#1012382). - dmaengine: at_hdmac: fix memory leak in at_dma_xlate() (bnc#1012382). - dmaengine: at_hdmac: fix module unloading (bnc#1012382). - dm cache metadata: ignore hints array being too small during resize (Git-fixes). - dm crypt: add cryptographic data integrity protection (authenticated encryption) (Git-fixes). - dm crypt: factor IV constructor out to separate function (Git-fixes). - dm crypt: fix crash by adding missing check for auth key size (git-fixes). - dm crypt: fix error return code in crypt_ctr() (git-fixes). - dm crypt: fix memory leak in crypt_ctr_cipher_old() (git-fixes). - dm crypt: introduce new format of cipher with "capi:" prefix (Git-fixes). - dm crypt: wipe kernel key copy after IV initialization (Git-fixes). - dm: do not allow readahead to limit IO size (git fixes (readahead)). - dm kcopyd: Fix bug causing workqueue stalls (bnc#1012382). - dm-multipath: do not assign cmd_flags in setup_clone() (bsc#1103156). - dm snapshot: Fix excessive memory usage and workqueue stalls (bnc#1012382). - dm thin: stop no_space_timeout worker when switching to write-mode (Git-fixes). - drivers: hv: vmbus: check the creation_status in vmbus_establish_gpadl() (bsc#1104098). - drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels (bnc#1012382). - drivers/sbus/char: add of_node_put() (bnc#1012382). - drivers/tty: add missing of_node_put() (bnc#1012382). - drm/ast: change resolution may cause screen blurred (bnc#1012382). - drm/ast: fixed cursor may disappear sometimes (bnc#1012382). - drm/ast: fixed reading monitor EDID not stable issue (bnc#1012382). - drm/ast: Fix incorrect free on ioregs (bsc#1106929) - drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock (bsc#1106929) - drm/ioctl: Fix Spectre v1 vulnerabilities (bnc#1012382). - drm/msm: Grab a vblank reference when waiting for commit_done (bnc#1012382). - drm: rcar-du: Fix external clock error checks (bsc#1106929) - drm: rcar-du: Fix vblank initialization (bsc#1106929) - e1000e: allow non-monotonic SYSTIM readings (bnc#1012382). - EDAC: Raise the maximum number of memory controllers (bsc#1120722). - efi/libstub/arm64: Use hidden attribute for struct screen_info reference (bsc#1122650). - exec: avoid gcc-8 warning for get_task_comm (bnc#1012382). - exportfs: do not read dentry after free (bnc#1012382). - ext2: fix potential use after free (bnc#1012382). - ext4: fix a potential fiemap/page fault deadlock w/ inline_data (bnc#1012382). - ext4: Fix crash during online resizing (bsc#1122779). - ext4: fix EXT4_IOC_GROUP_ADD ioctl (bnc#1012382). - ext4: fix possible use after free in ext4_quota_enable (bnc#1012382). - ext4: force inode writes when nfsd calls commit_metadata() (bnc#1012382). - ext4: missing unlock/put_page() in ext4_try_to_write_inline_data() (bnc#1012382). - f2fs: Add sanity_check_inode() function (bnc#1012382). - f2fs: avoid unneeded loop in build_sit_entries (bnc#1012382). - f2fs: check blkaddr more accuratly before issue a bio (bnc#1012382). - f2fs: clean up argument of recover_data (bnc#1012382). - f2fs: clean up with is_valid_blkaddr() (bnc#1012382). - f2fs: detect wrong layout (bnc#1012382). - f2fs: enhance sanity_check_raw_super() to avoid potential overflow (bnc#1012382). - f2fs: factor out fsync inode entry operations (bnc#1012382). - f2fs: fix inode cache leak (bnc#1012382). - f2fs: fix invalid memory access (bnc#1012382). - f2fs: fix missing up_read (bnc#1012382). - f2fs: fix to avoid reading out encrypted data in page cache (bnc#1012382). - f2fs: fix to convert inline directory correctly (bnc#1012382). - f2fs: fix to determine start_cp_addr by sbi->cur_cp_pack (bnc#1012382). - f2fs: fix to do sanity check with block address in main area (bnc#1012382). - f2fs: fix to do sanity check with block address in main area v2 (bnc#1012382). - f2fs: fix to do sanity check with cp_pack_start_sum (bnc#1012382). - f2fs: fix to do sanity check with node footer and iblocks (bnc#1012382). - f2fs: fix to do sanity check with reserved blkaddr of inline inode (bnc#1012382). - f2fs: fix to do sanity check with secs_per_zone (bnc#1012382). - f2fs: fix to do sanity check with user_block_count (bnc#1012382). - f2fs: fix validation of the block count in sanity_check_raw_super (bnc#1012382). - f2fs: free meta pages if sanity check for ckpt is failed (bnc#1012382). - f2fs: give -EINVAL for norecovery and rw mount (bnc#1012382). - f2fs: introduce and spread verify_blkaddr (bnc#1012382). - f2fs: introduce get_checkpoint_version for cleanup (bnc#1012382). - f2fs: move sanity checking of cp into get_valid_checkpoint (bnc#1012382). - f2fs: not allow to write illegal blkaddr (bnc#1012382). - f2fs: put directory inodes before checkpoint in roll-forward recovery (bnc#1012382). - f2fs: remove an obsolete variable (bnc#1012382). - f2fs: return error during fill_super (bnc#1012382). - f2fs: sanity check on sit entry (bnc#1012382). - f2fs: use crc and cp version to determine roll-forward recovery (bnc#1012382). - fbdev: fbcon: Fix unregister crash when more than one framebuffer (bsc#1106929) - fbdev: fbmem: behave better with small rotated displays and many CPUs (bsc#1106929) - fix fragmentation series - Fix problem with sharetransport= and NFSv4 (bsc#1114893). - floppy: fix race condition in __floppy_read_block_0() (Git-fixes). - fork: record start_time late (bnc#1012382). - fscache, cachefiles: remove redundant variable 'cache' (bnc#1012382). - fscache: Fix race in fscache_op_complete() due to split atomic_sub & read (Git-fixes). - fscache: Pass the correct cancelled indications to fscache_op_complete() (Git-fixes). - genwqe: Fix size check (bnc#1012382). - gfs2: Do not leave s_fs_info pointing to freed memory in init_sbd (bnc#1012382). - gfs2: Fix loop in gfs2_rbm_find (bnc#1012382). - git_sort.py: Remove non-existent remote tj/libata - gpiolib: Fix return value of gpio_to_desc() stub if !GPIOLIB (Git-fixes). - gpio: max7301: fix driver for use with CONFIG_VMAP_STACK (bnc#1012382). - gro_cell: add napi_disable in gro_cells_destroy (bnc#1012382). - hfs: do not free node before using (bnc#1012382). - hfsplus: do not free node before using (bnc#1012382). - hpwdt add dynamic debugging (bsc#1114417). - hpwdt calculate reload value on each use (bsc#1114417). - hugetlbfs: fix bug in pgoff overflow checking (bnc#1012382). - hwmon: (ina2xx) Fix current value calculation (bnc#1012382). - hwmon: (w83795) temp4_type has writable permission (bnc#1012382). - hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined (bnc#1116336). - i2c: axxia: properly handle master timeout (bnc#1012382). - i2c: dev: prevent adapter retries and timeout being set as minus value (bnc#1012382). - i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node (bnc#1012382). - ib/hfi1: Fix an out-of-bounds access in get_hw_stats (). - ibmveth: Do not process frames after calling napi_reschedule (bcs#1123357). - ibmveth: fix DMA unmap error in ibmveth_xmit_start error path (bnc#1012382). - ibmvnic: Add ethtool private flag for driver-defined queue limits (bsc#1121726). - ibmvnic: Convert reset work item mutex to spin lock (). - ibmvnic: Fix non-atomic memory allocation in IRQ context (). - ibmvnic: Increase maximum queue size limit (bsc#1121726). - ibmvnic: Introduce driver limits for ring sizes (bsc#1121726). - ide: pmac: add of_node_put() (bnc#1012382). - ieee802154: lowpan_header_create check must check daddr (bnc#1012382). - input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15ARR (bnc#1012382). - input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G (bnc#1012382). - input: elan_i2c - add ELAN0620 to the ACPI table (bnc#1012382). - input: elan_i2c - add support for ELAN0621 touchpad (bnc#1012382). - input: matrix_keypad - check for errors from of_get_named_gpio() (bnc#1012382). - input: omap-keypad - fix idle configuration to not block SoC idle states (bnc#1012382). - input: omap-keypad - fix keyboard debounce configuration (bnc#1012382). - input: restore EV_ABS ABS_RESERVED (bnc#1012382). - input: xpad - add GPD Win 2 Controller USB IDs (bnc#1012382). - input: xpad - add Mad Catz FightStick TE 2 VID/PID (bnc#1012382). - input: xpad - add more third-party controllers (bnc#1012382). - input: xpad - add PDP device id 0x02a4 (bnc#1012382). - input: xpad - add product ID for Xbox One S pad (bnc#1012382). - input: xpad - add support for PDP Xbox One controllers (bnc#1012382). - input: xpad - add support for Xbox1 PDP Camo series gamepad (bnc#1012382). - input: xpad - add USB IDs for Mad Catz Brawlstick and Razer Sabertooth (bnc#1012382). - input: xpad - avoid using __set_bit() for capabilities (bnc#1012382). - input: xpad - constify usb_device_id (bnc#1012382). - input: xpad - correctly sort vendor id's (bnc#1012382). - input: xpad - correct xbox one pad device name (bnc#1012382). - input: xpad - do not depend on endpoint order (bnc#1012382). - input: xpad - fix GPD Win 2 controller name (bnc#1012382). - input: xpad - fix PowerA init quirk for some gamepad models (bnc#1012382). - input: xpad - fix rumble on Xbox One controllers with 2015 firmware (bnc#1012382). - input: xpad - fix some coding style issues (bnc#1012382). - input: xpad - fix stuck mode button on Xbox One S pad (bnc#1012382). - input: xpad - fix Xbox One rumble stopping after 2.5 secs (bnc#1012382). - input: xpad - handle "present" and "gone" correctly (bnc#1012382). - input: xpad - move reporting xbox one home button to common function (bnc#1012382). - input: xpad - power off wireless 360 controllers on suspend (bnc#1012382). - input: xpad - prevent spurious input from wired Xbox 360 controllers (bnc#1012382). - input: xpad - quirk all PDP Xbox One gamepads (bnc#1012382). - input: xpad - remove spurious events of wireless xpad 360 controller (bnc#1012382). - input: xpad - remove unused function (bnc#1012382). - input: xpad - restore LED state after device resume (bnc#1012382). - input: xpad - simplify error condition in init_output (bnc#1012382). - input: xpad - sort supported devices by USB ID (bnc#1012382). - input: xpad - support some quirky Xbox One pads (bnc#1012382). - input: xpad - sync supported devices with 360Controller (bnc#1012382). - input: xpad - sync supported devices with XBCD (bnc#1012382). - input: xpad - sync supported devices with xboxdrv (bnc#1012382). - input: xpad - update Xbox One Force Feedback Support (bnc#1012382). - input: xpad - use LED API when identifying wireless controllers (bnc#1012382). - input: xpad - validate USB endpoint type during probe (bnc#1012382). - input: xpad - workaround dead irq_out after suspend/ resume (bnc#1012382). - input: xpad - xbox one elite controller support (bnc#1012382). - intel_th: msu: Fix an off-by-one in attribute store (bnc#1012382). - iommu/amd: Call free_iova_fast with pfn in map_sg (bsc#1106105). - iommu/amd: Fix amd_iommu=force_isolation (bsc#1106105). - iommu/amd: Fix IOMMU page flush when detach device from a domain (bsc#1106105). - iommu/amd: Unmap all mapped pages in error path of map_sg (bsc#1106105). - iommu/vt-d: Fix memory leak in intel_iommu_put_resv_regions() (bsc#1106105). - iommu/vt-d: Handle domain agaw being less than iommu agaw (bsc#1106105). - ip6mr: Fix potential Spectre v1 vulnerability (bnc#1012382). - ipmi:ssif: Fix handling of multi-part return messages (bnc#1012382). - ip: on queued skb use skb_header_pointer instead of pskb_may_pull (bnc#1012382). - ip_tunnel: Fix name string concatenate in __ip_tunnel_create() (bnc#1012382). - ipv4: Fix potential Spectre v1 vulnerability (bnc#1012382). - ipv4: ipv6: netfilter: Adjust the frag mem limit when truesize changes (bsc#1110286). - ipv6: Check available headroom in ip6_xmit() even without options (bnc#1012382). - ipv6: Consider sk_bound_dev_if when binding a socket to a v4 mapped address (bnc#1012382). - ipv6: explicitly initialize udp6_addr in udp_sock_create6() (bnc#1012382). - ipv6: fix kernel-infoleak in ipv6_local_error() (bnc#1012382). - ipv6: Take rcu_read_lock in __inet6_bind for mapped addresses (bnc#1012382). - isdn: fix kernel-infoleak in capi_unlocked_ioctl (bnc#1012382). - iser: set sector for ambiguous mr status errors (bnc#1012382). - iwlwifi: mvm: fix regulatory domain update when the firmware starts (bnc#1012382). - iwlwifi: mvm: support sta_statistics() even on older firmware (bnc#1012382). - ixgbe: Add function for checking to see if we can reuse page (bsc#1100105). - ixgbe: Add support for build_skb (bsc#1100105). - ixgbe: Add support for padding packet (bsc#1100105). - ixgbe: Break out Rx buffer page management (bsc#1100105). - ixgbe: Fix output from ixgbe_dump (bsc#1100105). - ixgbe: fix possible race in reset subtask (bsc#1101557). - ixgbe: Make use of order 1 pages and 3K buffers independent of FCoE (bsc#1100105). - ixgbe: Only DMA sync frame length (bsc#1100105). - ixgbe: recognize 1000BaseLX SFP modules as 1Gbps (bnc#1012382). - ixgbe: Refactor queue disable logic to take completion time into account (bsc#1101557). - ixgbe: Reorder Tx/Rx shutdown to reduce time needed to stop device (bsc#1101557). - ixgbe: Update code to better handle incrementing page count (bsc#1100105). - ixgbe: Update driver to make use of DMA attributes in Rx path (bsc#1100105). - ixgbe: Use length to determine if descriptor is done (bsc#1100105). - jffs2: Fix use of uninitialized delayed_work, lockdep breakage (bnc#1012382). - kabi: hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined (bnc#1116336). - kabi: reorder new slabinfo fields in struct kmem_cache_node (bnc#1116653). - kbuild: suppress packed-not-aligned warning for default setting only (bnc#1012382). - kconfig: fix file name and line number of warn_ignored_character() (bnc#1012382). - kconfig: fix memory leak when EOF is encountered in quotation (bnc#1012382). - kdb: use memmove instead of overlapping memcpy (bnc#1012382). - kdb: Use strscpy with destination buffer size (bnc#1012382). - kernfs: Replace strncpy with memcpy (bnc#1012382). - kgdboc: fix KASAN global-out-of-bounds bug in param_set_kgdboc_var() (bnc#1012382). - kgdboc: Fix restrict error (bnc#1012382). - kgdboc: Fix warning with module build (bnc#1012382). - kobject: Replace strncpy with memcpy (bnc#1012382). - kvm/arm64: Fix caching of host MDCR_EL2 value (bsc#1121242). - kvm/arm: Restore banked registers and physical timer access on hyp_panic() (bsc#1121240). - kvm/mmu: Fix race in emulated page table writes (bnc#1012382). - kvm/nVMX: Eliminate vmcs02 pool (bnc#1012382). - kvm/nVMX: mark vmcs12 pages dirty on L2 exit (bnc#1012382). - kvm/PPC: Move and undef TRACE_INCLUDE_PATH/FILE (bnc#1012382). - kvm/svm: Allow direct access to MSR_IA32_SPEC_CTRL (bnc#1012382 bsc#1068032). - kvm/svm: Ensure an IBPB on all affected CPUs when freeing a vmcb (bsc#1114648). - kvm/VMX: Allow direct access to MSR_IA32_SPEC_CTRL (bnc#1012382 bsc#1068032 bsc#1096242 bsc#1096281). - kvm/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES (bnc#1012382). - kvm/VMX: introduce alloc_loaded_vmcs (bnc#1012382). - kvm/VMX: make MSR bitmaps per-VCPU (bnc#1012382). - kvm/x86: Add IBPB support (bnc#1012382 bsc#1068032 bsc#1068032). - kvm/x86: fix empty-body warnings (bnc#1012382). - kvm/x86: Remove indirect MSR op calls from SPEC_CTRL (bnc#1012382). - kvm/x86: Use jmp to invoke kvm_spurious_fault() from .fixup (bnc#1012382). - leds: call led_pwm_set() in leds-pwm to enforce default LED_OFF (bnc#1012382). - leds: leds-gpio: Fix return value check in create_gpio_led() (bnc#1012382). - leds: turn off the LED and wait for completion on unregistering LED class device (bnc#1012382). - libata: whitelist all SAMSUNG MZ7KM* solid-state disks (bnc#1012382). - libceph: fall back to sendmsg for slab pages (bsc#1118316). - libfc: sync strings with upstream versions (bsc#1114763). - lib/interval_tree_test.c: allow full tree search (bnc#1012382). - lib/interval_tree_test.c: allow users to limit scope of endpoint (bnc#1012382). - lib/interval_tree_test.c: make test options module parameters (bnc#1012382). - libnvdimm, {btt, blk}: do integrity setup before add_disk() (bsc#1118926). - libnvdimm, dimm: fix dpa reservation vs uninitialized label area (bsc#1118936). - libnvdimm: fix integer overflow static analysis warning (bsc#1118922). - libnvdimm: fix nvdimm_bus_lock() vs device_lock() ordering (bsc#1118915). - lib/rbtree_test.c: make input module parameters (bnc#1012382). - lib/rbtree-test: lower default params (bnc#1012382). - llc: do not use sk_eat_skb() (bnc#1012382). - loop: Fix double mutex_unlock(&loop_ctl_mutex) in loop_control_ioctl() (bnc#1012382). - loop: Fold __loop_release into loop_release (bnc#1012382). - loop: Get rid of loop_index_mutex (bnc#1012382). - LSM: Check for NULL cred-security on free (bnc#1012382). - mac80211: Clear beacon_int in ieee80211_do_stop (bnc#1012382). - mac80211: fix reordering of buffered broadcast packets (bnc#1012382). - mac80211_hwsim: fix module init error paths for netlink (bnc#1012382). - mac80211_hwsim: Timer should be initialized before device registered (bnc#1012382). - mac80211: ignore NullFunc frames in the duplicate detection (bnc#1012382). - mac80211: ignore tx status for PS stations in ieee80211_tx_status_ext (bnc#1012382). - matroxfb: fix size of memcpy (bnc#1012382). - md: batch flush requests (bsc#1119680). - md: do not check MD_SB_CHANGE_CLEAN in md_allow_write (Git-fixes). - media: dvb-frontends: fix i2c access helpers for KASAN (bnc#1012382). - media: em28xx: Fix misplaced reset of dev->v4l::field_count (bnc#1012382). - media: em28xx: Fix use-after-free when disconnecting (bnc#1012382). - media: firewire: Fix app_info parameter type in avc_ca{,_app}_info (bnc#1012382). - media: vb2: be sure to unlock mutex on errors (bnc#1012382). - media: vb2: vb2_mmap: move lock up (bnc#1012382). - media: vivid: fix error handling of kthread_run (bnc#1012382). - media: vivid: free bitmap_cap when updating std/timings/etc (bnc#1012382). - media: vivid: set min width/height to a value > 0 (bnc#1012382). - mfd: tps6586x: Handle interrupts on suspend (bnc#1012382). - mips: Align kernel load address to 64KB (bnc#1012382). - mips: Ensure pmd_present() returns false after pmd_mknotpresent() (bnc#1012382). - mips: fix mips_get_syscall_arg o32 check (bnc#1012382). - mips: fix n32 compat_ipc_parse_version (bnc#1012382). - mips: ralink: Fix mt7620 nd_sd pinmux (bnc#1012382). - MIPS: SiByte: Enable swiotlb for SWARM, LittleSur and BigSur (bnc#1012382). - misc: mic/scif: fix copy-paste error in scif_create_remote_lookup (bnc#1012382). - mmc: atmel-mci: do not assume idle after atmci_request_end (bnc#1012382). - mmc: core: Reset HPI enabled state during re-init and in case of errors (bnc#1012382). - mm: cleancache: fix corruption on missed inode invalidation (bnc#1012382). - MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310 (bnc#1012382). - mmc: omap_hsmmc: fix DMA API warning (bnc#1012382). - mm, devm_memremap_pages: kill mapping "System RAM" support (bnc#1012382). - mm: do not miss the last page because of round-off error (bnc#1118798). - mm, hugetlb: fix huge_pte_alloc BUG_ON (bsc#1119204). - mm: hwpoison: call shake_page() after try_to_unmap() for mlocked page (bnc#1116336). - mm: lower the printk loglevel for __dump_page messages (generic hotplug debugability). - mm, memory_hotplug: be more verbose for memory offline failures (generic hotplug debugability). - mm, memory_hotplug: drop pointless block alignment checks from __offline_pages (generic hotplug debugability). - mm, memory_hotplug: print reason for the offlining failure (generic hotplug debugability). - mm: mlock: avoid increase mm->locked_vm on mlock() when already mlock2(,MLOCK_ONFAULT) (bnc#1012382). - mm/nommu.c: Switch __get_user_pages_unlocked() to use __get_user_pages() (bnc#1012382). - mm: only report isolation failures when offlining memory (generic hotplug debugability). - mm/page-writeback.c: do not break integrity writeback on ->writepage() error (bnc#1012382). - mm: Preserve _PAGE_DEVMAP across mprotect() calls (bsc#1118790). - mm: print more information about mapping in __dump_page (generic hotplug debugability). - mm, proc: be more verbose about unstable VMA flags in /proc/<pid>/smaps (bnc#1012382). - mm: put_and_wait_on_page_locked() while page is migrated (bnc#1109272). - mm: remove write/force parameters from __get_user_pages_locked() (bnc#1012382 bsc#1027260). - mm: remove write/force parameters from __get_user_pages_unlocked() (bnc#1012382 bsc#1027260). - mm: replace __access_remote_vm() write parameter with gup_flags (bnc#1012382). - mm: replace access_remote_vm() write parameter with gup_flags (bnc#1012382). - mm: replace get_user_pages_locked() write/force parameters with gup_flags (bnc#1012382 bsc#1027260). - mm: replace get_user_pages_unlocked() write/force parameters with gup_flags (bnc#1012382 bsc#1027260). - mm: replace get_user_pages() write/force parameters with gup_flags (bnc#1012382 bsc#1027260). - mm: replace get_vaddr_frames() write/force parameters with gup_flags (bnc#1012382). - mm, slab: faster active and free stats (bsc#116653, VM Performance). - mm/slab: improve performance of gathering slabinfo stats (bsc#116653, VM Performance). - mm, slab: maintain total slab count instead of active count (bsc#116653, VM Performance). - Move patches to sorted range, p1 - mv88e6060: disable hardware level MAC learning (bnc#1012382). - mwifiex: Fix NULL pointer dereference in skb_dequeue() (bnc#1012382). - mwifiex: fix p2p device does not find in scan problem (bnc#1012382). - namei: allow restricted O_CREAT of FIFOs and regular files (bnc#1012382). - neighbour: Avoid writing before skb->head in neigh_hh_output() (bnc#1012382). - net: 8139cp: fix a BUG triggered by changing mtu with network traffic (bnc#1012382). - net: amd: add missing of_node_put() (bnc#1012382). - net: bcmgenet: fix OF child-node lookup (bnc#1012382). - net: bridge: fix a bug on using a neighbour cache entry without checking its state (bnc#1012382). - net: call sk_dst_reset when set SO_DONTROUTE (bnc#1012382). - net: ena: fix crash during ena_remove() (bsc#1108240). - net: ena: update driver version from 2.0.1 to 2.0.2 (bsc#1108240). - net: faraday: ftmac100: remove netif_running(netdev) check before disabling interrupts (bnc#1012382). - netfilter: nf_tables: fix oops when inserting an element into a verdict map (bnc#1012382). - net: hisilicon: remove unexpected free_netdev (bnc#1012382). - net/ibmvnic: Fix RTNL deadlock during device reset (bnc#1115431). - net: ipv4: do not handle duplicate fragments as overlapping (bsc#1116345). - net/mlx4_core: Correctly set PFC param if global pause is turned off (bsc#1015336 bsc#1015337 bsc#1015340). - net/mlx4_core: Fix uninitialized variable compilation warning (bnc#1012382). - net/mlx4_core: Zero out lkey field in SW2HW_MPT fw command (bnc#1012382). - net/mlx4: Fix UBSAN warning of signed integer overflow (bnc#1012382). - net: phy: do not allow __set_phy_supported to add unsupported modes (bnc#1012382). - net: Prevent invalid access to skb->prev in __qdisc_drop_all (bnc#1012382). - netrom: fix locking in nr_find_socket() (bnc#1012382). - net: speed up skb_rbtree_purge() (bnc#1012382). - net: thunderx: fix NULL pointer dereference in nic_remove (bnc#1012382). - nfc: nfcmrvl_uart: fix OF child-node lookup (bnc#1012382). - nfit: skip region registration for incomplete control regions (bsc#1118930). - nfsv4: Do not exit the state manager without clearing NFS4CLNT_MANAGER_RUNNING (git-fixes). - nvme: validate controller state before rescheduling keep alive (bsc#1103257). - ocfs2: fix deadlock caused by ocfs2_defrag_extent() (bnc#1012382). - ocfs2: fix panic due to unrecovered local alloc (bnc#1012382). - ocfs2: fix potential use after free (bnc#1012382). - of: add helper to lookup compatible child node (bnc#1012382). - omap2fb: Fix stack memory disclosure (bsc#1106929) - packet: Do not leak dev refcounts on error exit (bnc#1012382). - packet: validate address length (bnc#1012382). - packet: validate address length if non-zero (bnc#1012382). - pci: altera: Check link status before retrain link (bnc#1012382). - pci: altera: Fix altera_pcie_link_is_up() (bnc#1012382). - pci: altera: Move retrain from fixup to altera_pcie_host_init() (bnc#1012382). - pci: altera: Poll for link training status after retraining the link (bnc#1012382). - pci: altera: Poll for link up status after retraining the link (bnc#1012382). - pci: altera: Reorder read/write functions (bnc#1012382). - pci: altera: Rework config accessors for use without a struct pci_bus (bnc#1012382). - perf/bpf: Convert perf_event_array to use struct file (bsc#1119967). - perf intel-pt: Fix error with config term "pt=0" (bnc#1012382). - perf parse-events: Fix unchecked usage of strncpy() (bnc#1012382). - perf pmu: Suppress potential format-truncation warning (bnc#1012382). - perf svghelper: Fix unchecked usage of strncpy() (bnc#1012382). - pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11 (bnc#1012382). - platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey (bnc#1012382). - powerpc/64s: consolidate MCE counter increment (bsc#1094244). - powerpc/boot: Fix random libfdt related build errors (bnc#1012382). - powerpc/boot: Request no dynamic linker for boot wrapper (bsc#1070805). - powerpc/cacheinfo: Report the correct shared_cpu_map on big-cores (bsc#1109695). - powerpc: Detect the presence of big-cores via "ibm, thread-groups" (bsc#1109695). - powerpc: Fix COFF zImage booting on old powermacs (bnc#1012382). - powerpc, hotplug: Avoid to touch non-existent cpumasks (bsc#1109695). - powerpc: make use of for_each_node_by_type() instead of open-coding it (bsc#1109695). - powerpc/msi: Fix NULL pointer access in teardown code (bnc#1012382). - powerpc/numa: Suppress "VPHN is not supported" messages (bnc#1012382). - powerpc/pseries/cpuidle: Fix preempt warning (bnc#1012382). - powerpc/setup: Add cpu_to_phys_id array (bsc#1109695). - powerpc/smp: Add cpu_l2_cache_map (bsc#1109695). - powerpc/smp: Add Power9 scheduler topology (bsc#1109695). - powerpc/smp: Rework CPU topology construction (bsc#1109695). - powerpc/smp: Use cpu_to_chip_id() to find core siblings (bsc#1109695). - powerpc/traps: restore recoverability of machine_check interrupts (bsc#1094244). - powerpc: Use cpu_smallcore_sibling_mask at SMT level on bigcores (bsc#1109695). - powerpc/xmon: Fix invocation inside lock region (bsc#1122885). - power: supply: olpc_battery: correct the temperature units (bnc#1012382). - proc: Remove empty line in /proc/self/status (bnc#1012382 bsc#1094823). - pstore: Convert console write to use ->write_buf (bnc#1012382). - pstore/ram: Do not treat empty buffers as valid (bnc#1012382). - qed: Fix bitmap_weight() check (bsc#1019695). - qed: Fix PTT leak in qed_drain() (bnc#1012382). - qed: Fix QM getters to always return a valid pq (bsc#1019695 ). - qed: Fix reading wrong value in loop condition (bnc#1012382). - r8169: Add support for new Realtek Ethernet (bnc#1012382). - rapidio/rionet: do not free skb before reading its length (bnc#1012382). - Refresh patches.kabi/x86-cpufeature-preserve-numbers.patch. (bsc#1122651) - Revert "drm/rockchip: Allow driver to be shutdown on reboot/kexec" (bsc#1106929) - Revert "exec: avoid gcc-8 warning for get_task_comm" (kabi). - Revert "iommu/io-pgtable-arm: Check for v7s-incapable systems" (bsc#1106105). - Revert "PCI/ASPM: Do not initialize link state when aspm_disabled is set" (bsc#1106105). - Revert "usb: musb: musb_host: Enable HCD_BH flag to handle urb return in bottom half" (bsc#1047487). - Revert "wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout()" (bnc#1012382). - rocker: fix rocker_tlv_put_* functions for KASAN (bnc#1012382). - rtc: snvs: add a missing write sync (bnc#1012382). - rtc: snvs: Add timeouts to avoid kernel lockups (bnc#1012382). - rtnetlink: ndo_dflt_fdb_dump() only work for ARPHRD_ETHER devices (bnc#1012382). - s390/cpum_cf: Reject request for sampling in event initialization (bnc#1012382). - s390/mm: Check for valid vma before zapping in gmap_discard (bnc#1012382). - s390/qeth: fix length check in SNMP processing (bnc#1012382). - sbus: char: add of_node_put() (bnc#1012382). - scsi: bfa: convert to strlcpy/strlcat (bnc#1012382 bsc#1019683, ). - scsi: bnx2fc: Fix NULL dereference in error handling (bnc#1012382). - scsi: Create two versions of scsi_internal_device_unblock() (bsc#1119877). - scsi: csiostor: Avoid content leaks and casts (bnc#1012382). - scsi: Introduce scsi_start_queue() (bsc#1119877). - scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset (bnc#1012382). - scsi: lpfc: Add Buffer overflow check, when nvme_info larger than PAGE_SIZE (bsc#1102660). - scsi: lpfc: devloss timeout race condition caused null pointer reference (bsc#1102660). - scsi: lpfc: Fix abort error path for NVMET (bsc#1102660). - scsi: lpfc: fix block guard enablement on SLI3 adapters (bsc#1079935). - scsi: lpfc: Fix driver crash when re-registering NVME rports (bsc#1102660). - scsi: lpfc: Fix ELS abort on SLI-3 adapters (bsc#1102660). - scsi: lpfc: Fix list corruption on the completion queue (bsc#1102660). - scsi: lpfc: Fix NVME Target crash in defer rcv logic (bsc#1102660). - scsi: lpfc: Fix panic if driver unloaded when port is offline (bsc#1102660). - scsi: lpfc: update driver version to 11.4.0.7-5 (bsc#1102660). - scsi: Make __scsi_remove_device go straight from BLOCKED to DEL (bsc#1119877). - scsi: megaraid: fix out-of-bound array accesses (bnc#1012382). - scsi: Protect SCSI device state changes with a mutex (bsc#1119877). - scsi: qedi: Add ISCSI_BOOT_SYSFS to Kconfig (bsc#1043083). - scsi: Re-export scsi_internal_device_{,un}_block() (bsc#1119877). - scsi: sd: Fix cache_type_store() (bnc#1012382). - scsi: Split scsi_internal_device_block() (bsc#1119877). - scsi: target: add emulate_pr backstore attr to toggle PR support (bsc#1091405). - scsi: target: drop unused pi_prot_format attribute storage (bsc#1091405). - scsi: target: use consistent left-aligned ASCII INQUIRY data (bnc#1012382). - scsi: ufs: fix bugs related to null pointer access and array size (bnc#1012382). - scsi: ufs: fix race between clock gating and devfreq scaling work (bnc#1012382). - scsi: ufshcd: Fix race between clk scaling and ungate work (bnc#1012382). - scsi: ufshcd: release resources if probe fails (bnc#1012382). - scsi: use 'inquiry_mutex' instead of 'state_mutex' (bsc#1119877). - scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq during unload (bnc#1012382). - scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown (bnc#1012382). - sctp: allocate sctp_sockaddr_entry with kzalloc (bnc#1012382). - sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer (bnc#1012382). - sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event (bnc#1012382). - selftests: Move networking/timestamping from Documentation (bnc#1012382). - selinux: fix GPF on invalid policy (bnc#1012382). - seq_file: fix incomplete reset on read from zero offset (Git-fixes). - series.conf: Move 'patches.fixes/aio-hold-an-extra-file-reference-over-AIO-read-write.patch' into sorted section. - slab: alien caches must not be initialized if the allocation of the alien cache failed (bnc#1012382). - sock: Make sock->sk_stamp thread-safe (bnc#1012382). - spi: bcm2835: Avoid finishing transfer prematurely in IRQ mode (bnc#1012382). - spi: bcm2835: Fix book-keeping of DMA termination (bnc#1012382). - spi: bcm2835: Fix race on DMA termination (bnc#1012382). - spi: bcm2835: Unbreak the build of esoteric configs (bnc#1012382). - sr: pass down correctly sized SCSI sense buffer (bnc#1012382). - Staging: lustre: remove two build warnings (bnc#1012382). - staging: rts5208: fix gcc-8 logic error warning (bnc#1012382). - staging: speakup: Replace strncpy with memcpy (bnc#1012382). - sunrpc: Fix a bogus get/put in generic_key_to_expire() (bnc#1012382). - sunrpc: Fix a potential race in xprt_connect() (git-fixes). - sunrpc: fix cache_head leak due to queued request (bnc#1012382). - sunrpc: Fix leak of krb5p encode pages (bnc#1012382). - sunrpc: handle ENOMEM in rpcb_getport_async (bnc#1012382). - swiotlb: clean up reporting (bnc#1012382). - sysfs: Disable lockdep for driver bind/unbind files (bnc#1012382). - sysv: return 'err' instead of 0 in __sysv_write_inode (bnc#1012382). - target/iscsi: avoid NULL dereference in CHAP auth error path (bsc#1117165). - target: se_dev_attrib.emulate_pr ABI stability (bsc#1091405). - tcp: fix NULL ref in tail loss probe (bnc#1012382). - timer/debug: Change /proc/timer_list from 0444 to 0400 (bnc#1012382). - tipc: fix uninit-value in tipc_nl_compat_bearer_enable (bnc#1012382). - tipc: fix uninit-value in tipc_nl_compat_doit (bnc#1012382). - tipc: fix uninit-value in tipc_nl_compat_link_reset_stats (bnc#1012382). - tipc: fix uninit-value in tipc_nl_compat_link_set (bnc#1012382). - tipc: fix uninit-value in tipc_nl_compat_name_table_dump (bnc#1012382). - tmpfs: make lseek(SEEK_DATA/SEK_HOLE) return ENXIO with a negative offset (bnc#1012382). - tpm: fix response size validation in tpm_get_random() (bsc#1020645, git-fixes). - tracing: Fix bad use of igrab in trace_uprobe.c (bsc#1120046). - tracing: Fix memory leak in set_trigger_filter() (bnc#1012382). - tracing: Fix memory leak of instance function hash filters (bnc#1012382). - tty/ldsem: Wake up readers after timed out down_write() (bnc#1012382). - tty: serial: 8250_mtk: always resume the device in probe (bnc#1012382). - tty: wipe buffer (bnc#1012382). - tty: wipe buffer if not echoing data (bnc#1012382). - tun: forbid iface creation with rtnl ops (bnc#1012382). - unifdef: use memcpy instead of strncpy (bnc#1012382). - Update config files: disable f2fs in the rest configs (boo#1109665) - uprobes: Fix handle_swbp() vs. unregister() + register() race once more (bnc#1012382). - usb: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB (bnc#1012382). - usb: appledisplay: Add 27" Apple Cinema Display (bnc#1012382). - usb: cdc-acm: send ZLP for Telit 3G Intel based modems (bnc#1012382). - usb: check usb_get_extra_descriptor for proper size (bnc#1012382). - usb: core: Fix hub port connection events lost (bnc#1012382). - usb: core: quirks: add RESET_RESUME quirk for Cherry G230 Stream series (bnc#1012382). - usb: gadget: dummy: fix nonsensical comparisons (bnc#1012382). - usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2 (bnc#1012382). - usb: omap_udc: fix crashes on probe error and module removal (bnc#1012382). - usb: omap_udc: fix omap_udc_start() on 15xx machines (bnc#1012382). - usb: omap_udc: fix USB gadget functionality on Palm Tungsten E (bnc#1012382). - usb: omap_udc: use devm_request_irq() (bnc#1012382). - usb: quirk: add no-LPM quirk on SanDisk Ultra Flair device (bnc#1012382). - usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable() (bnc#1012382). - usb: serial: option: add Fibocom NL668 series (bnc#1012382). - usb: serial: option: add Fibocom NL678 series (bnc#1012382). - usb: serial: option: add GosunCn ZTE WeLink ME3630 (bnc#1012382). - usb: serial: option: add HP lt4132 (bnc#1012382). - usb: serial: option: add Simcom SIM7500/SIM7600 (MBIM mode) (bnc#1012382). - usb: serial: option: add Telit LN940 series (bnc#1012382). - usb: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays (bnc#1012382). - usb: storage: add quirk for SMI SM3350 (bnc#1012382). - usb: storage: do not insert sane sense for SPC3+ when bad sense specified (bnc#1012382). - usb: usb-storage: Add new IDs to ums-realtek (bnc#1012382). - usb: xhci: fix timeout for transition from RExit to U0 (bnc#1012382). - usb: xhci: fix uninitialized completion when USB3 port got wrong status (bnc#1012382). - usb: xhci: Prevent bus suspend if a port connect change or polling state is detected (bnc#1012382). - v9fs_dir_readdir: fix double-free on p9stat_read error (bnc#1012382). - vfs: Avoid softlockups in drop_pagecache_sb() (bsc#1118505). - vhost: make sure used idx is seen before log in vhost_add_used_n() (bnc#1012382). - virtio/s390: avoid race on vcdev->config (bnc#1012382). - virtio/s390: fix race in ccw_io_helper() (bnc#1012382). - VSOCK: Send reset control packet when socket is partially bound (bnc#1012382). - writeback: do not decrement wb->refcnt if !wb->bdi (git fixes (writeback)). - x86/earlyprintk/efi: Fix infinite loop on some screen widths (bnc#1012382). - x86/entry: spell EBX register correctly in documentation (bnc#1012382). - x86/MCE: Export memory_error() (bsc#1114648). - x86/MCE: Make correctable error detection look at the Deferred bit (bsc#1114648). - x86/mtrr: Do not copy uninitialized gentry fields back to userspace (bnc#1012382). - x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off (bnc#1114871). - x86/speculation: Use synthetic bits for IBRS/IBPB/STIBP (bnc#1012382). - xen/balloon: Support xend-based toolstack (bnc#1065600). - xen/netback: dont overflow meta array (bnc#1099523). - xen/netfront: tolerate frags with no data (bnc#1012382). - xen/x86: add diagnostic printout to xen_mc_flush() in case of error (bnc#1116183). - xen: xlate_mmu: add missing header to fix 'W=1' warning (bnc#1012382). - xfrm: Fix bucket count reported to userspace (bnc#1012382). - xfs: Align compat attrlist_by_handle with native implementation (git-fixes). - xfs: fix quotacheck dquot id overflow infinite loop (bsc#1121621). - xhci: Add quirk to workaround the errata seen on Cavium Thunder-X2 Soc (bsc#1117162). - xhci: Do not prevent USB2 bus suspend in state check intended for USB3 only (bnc#1012382). - xhci: Prevent U1/U2 link pm states if exit latency is too long (bnc#1012382). - xprtrdma: Reset credit grant properly after a disconnect (git-fixes). - xtensa: enable coprocessors that are being flushed (bnc#1012382). - xtensa: fix coprocessor context offset definitions (bnc#1012382). - Yama: Check for pid death before checking ancestry (bnc#1012382). - x86/pkeys: Properly copy pkey state at fork() (bsc#1106105). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-140=1 Package List: - openSUSE Leap 42.3 (x86_64): kernel-debug-4.4.172-86.1 kernel-debug-base-4.4.172-86.1 kernel-debug-base-debuginfo-4.4.172-86.1 kernel-debug-debuginfo-4.4.172-86.1 kernel-debug-debugsource-4.4.172-86.1 kernel-debug-devel-4.4.172-86.1 kernel-debug-devel-debuginfo-4.4.172-86.1 kernel-default-4.4.172-86.1 kernel-default-base-4.4.172-86.1 kernel-default-base-debuginfo-4.4.172-86.1 kernel-default-debuginfo-4.4.172-86.1 kernel-default-debugsource-4.4.172-86.1 kernel-default-devel-4.4.172-86.1 kernel-obs-build-4.4.172-86.1 kernel-obs-build-debugsource-4.4.172-86.1 kernel-obs-qa-4.4.172-86.1 kernel-syms-4.4.172-86.1 kernel-vanilla-4.4.172-86.1 kernel-vanilla-base-4.4.172-86.1 kernel-vanilla-base-debuginfo-4.4.172-86.1 kernel-vanilla-debuginfo-4.4.172-86.1 kernel-vanilla-debugsource-4.4.172-86.1 kernel-vanilla-devel-4.4.172-86.1 - openSUSE Leap 42.3 (noarch): kernel-devel-4.4.172-86.1 kernel-docs-4.4.172-86.1 kernel-docs-html-4.4.172-86.1 kernel-docs-pdf-4.4.172-86.1 kernel-macros-4.4.172-86.1 kernel-source-4.4.172-86.1 kernel-source-vanilla-4.4.172-86.1 References: https://www.suse.com/security/cve/CVE-2018-1120.html https://www.suse.com/security/cve/CVE-2018-16862.html https://www.suse.com/security/cve/CVE-2018-16884.html https://www.suse.com/security/cve/CVE-2018-19407.html https://www.suse.com/security/cve/CVE-2018-19824.html https://www.suse.com/security/cve/CVE-2018-19985.html https://www.suse.com/security/cve/CVE-2018-20169.html https://www.suse.com/security/cve/CVE-2018-9568.html https://www.suse.com/security/cve/CVE-2019-3459.html https://www.suse.com/security/cve/CVE-2019-3460.html https://bugzilla.suse.com/1012382 https://bugzilla.suse.com/1015336 https://bugzilla.suse.com/1015337 https://bugzilla.suse.com/1015340 https://bugzilla.suse.com/1019683 https://bugzilla.suse.com/1019695 https://bugzilla.suse.com/1020645 https://bugzilla.suse.com/1023175 https://bugzilla.suse.com/1027260 https://bugzilla.suse.com/1031492 https://bugzilla.suse.com/1043083 https://bugzilla.suse.com/1047487 https://bugzilla.suse.com/1065600 https://bugzilla.suse.com/1068032 https://bugzilla.suse.com/1070805 https://bugzilla.suse.com/1079935 https://bugzilla.suse.com/1086423 https://bugzilla.suse.com/1087082 https://bugzilla.suse.com/1091405 https://bugzilla.suse.com/1094244 https://bugzilla.suse.com/1094823 https://bugzilla.suse.com/1096242 https://bugzilla.suse.com/1096281 https://bugzilla.suse.com/1099523 https://bugzilla.suse.com/1100105 https://bugzilla.suse.com/1101557 https://bugzilla.suse.com/1102660 https://bugzilla.suse.com/1102875 https://bugzilla.suse.com/1102877 https://bugzilla.suse.com/1102879 https://bugzilla.suse.com/1102882 https://bugzilla.suse.com/1102896 https://bugzilla.suse.com/1103156 https://bugzilla.suse.com/1103257 https://bugzilla.suse.com/1104098 https://bugzilla.suse.com/1106105 https://bugzilla.suse.com/1106929 https://bugzilla.suse.com/1107866 https://bugzilla.suse.com/1108240 https://bugzilla.suse.com/1109272 https://bugzilla.suse.com/1109665 https://bugzilla.suse.com/1109695 https://bugzilla.suse.com/1110286 https://bugzilla.suse.com/1114417 https://bugzilla.suse.com/1114648 https://bugzilla.suse.com/1114763 https://bugzilla.suse.com/1114871 https://bugzilla.suse.com/1114893 https://bugzilla.suse.com/1115431 https://bugzilla.suse.com/1116027 https://bugzilla.suse.com/1116183 https://bugzilla.suse.com/1116336 https://bugzilla.suse.com/1116345 https://bugzilla.suse.com/1116653 https://bugzilla.suse.com/1116841 https://bugzilla.suse.com/1116962 https://bugzilla.suse.com/1117162 https://bugzilla.suse.com/1117165 https://bugzilla.suse.com/1117186 https://bugzilla.suse.com/1118152 https://bugzilla.suse.com/1118316 https://bugzilla.suse.com/1118319 https://bugzilla.suse.com/1118505 https://bugzilla.suse.com/1118790 https://bugzilla.suse.com/1118798 https://bugzilla.suse.com/1118915 https://bugzilla.suse.com/1118922 https://bugzilla.suse.com/1118926 https://bugzilla.suse.com/1118930 https://bugzilla.suse.com/1118936 https://bugzilla.suse.com/1119204 https://bugzilla.suse.com/1119680 https://bugzilla.suse.com/1119714 https://bugzilla.suse.com/1119877 https://bugzilla.suse.com/1119946 https://bugzilla.suse.com/1119967 https://bugzilla.suse.com/1119970 https://bugzilla.suse.com/1120046 https://bugzilla.suse.com/1120722 https://bugzilla.suse.com/1120743 https://bugzilla.suse.com/1120758 https://bugzilla.suse.com/1120902 https://bugzilla.suse.com/1120950 https://bugzilla.suse.com/1121239 https://bugzilla.suse.com/1121240 https://bugzilla.suse.com/1121241 https://bugzilla.suse.com/1121242 https://bugzilla.suse.com/1121275 https://bugzilla.suse.com/1121621 https://bugzilla.suse.com/1121726 https://bugzilla.suse.com/1122650 https://bugzilla.suse.com/1122651 https://bugzilla.suse.com/1122885 https://bugzilla.suse.com/1123321 https://bugzilla.suse.com/1123323 https://bugzilla.suse.com/1123357 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0139-1: important: Security update for krb5
by opensuse-security＠opensuse.org 05 Feb '19

05 Feb '19

openSUSE Security Update: Security update for krb5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0139-1 Rating: important References: #1083926 #1083927 Cross-References: CVE-2018-5729 CVE-2018-5730 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for krb5 fixes the following issues: Security issues fixed: - CVE-2018-5729, CVE-2018-5730: Fixed multiple flaws in LDAP DN checking (bsc#1083926, bsc#1083927) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-139=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): krb5-1.15.2-lp150.5.6.1 krb5-client-1.15.2-lp150.5.6.1 krb5-client-debuginfo-1.15.2-lp150.5.6.1 krb5-debuginfo-1.15.2-lp150.5.6.1 krb5-debugsource-1.15.2-lp150.5.6.1 krb5-devel-1.15.2-lp150.5.6.1 krb5-mini-1.15.2-lp150.5.6.1 krb5-mini-debuginfo-1.15.2-lp150.5.6.1 krb5-mini-debugsource-1.15.2-lp150.5.6.1 krb5-mini-devel-1.15.2-lp150.5.6.1 krb5-plugin-kdb-ldap-1.15.2-lp150.5.6.1 krb5-plugin-kdb-ldap-debuginfo-1.15.2-lp150.5.6.1 krb5-plugin-preauth-otp-1.15.2-lp150.5.6.1 krb5-plugin-preauth-otp-debuginfo-1.15.2-lp150.5.6.1 krb5-plugin-preauth-pkinit-1.15.2-lp150.5.6.1 krb5-plugin-preauth-pkinit-debuginfo-1.15.2-lp150.5.6.1 krb5-server-1.15.2-lp150.5.6.1 krb5-server-debuginfo-1.15.2-lp150.5.6.1 - openSUSE Leap 15.0 (x86_64): krb5-32bit-1.15.2-lp150.5.6.1 krb5-32bit-debuginfo-1.15.2-lp150.5.6.1 krb5-devel-32bit-1.15.2-lp150.5.6.1 References: https://www.suse.com/security/cve/CVE-2018-5729.html https://www.suse.com/security/cve/CVE-2018-5730.html https://bugzilla.suse.com/1083926 https://bugzilla.suse.com/1083927 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0138-1: important: Security update for mysql-community-server
by opensuse-security＠opensuse.org 05 Feb '19

05 Feb '19

openSUSE Security Update: Security update for mysql-community-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0138-1 Rating: important References: #1113652 #1122198 Cross-References: CVE-2018-0734 CVE-2019-2455 CVE-2019-2481 CVE-2019-2482 CVE-2019-2503 CVE-2019-2507 CVE-2019-2529 CVE-2019-2531 CVE-2019-2534 CVE-2019-2537 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for mysql-community-server to version 5.6.43 fixes the following issues: Security issues fixed: - CVE-2019-2534, CVE-2019-2529, CVE-2019-2482, CVE-2019-2455, CVE-2019-2503, CVE-2019-2537, CVE-2019-2481, CVE-2019-2507, CVE-2019-2531, CVE-2018-0734 (boo#1113652, boo#1122198) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-138=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libmysql56client18-5.6.43-45.1 libmysql56client18-debuginfo-5.6.43-45.1 libmysql56client_r18-5.6.43-45.1 mysql-community-server-5.6.43-45.1 mysql-community-server-bench-5.6.43-45.1 mysql-community-server-bench-debuginfo-5.6.43-45.1 mysql-community-server-client-5.6.43-45.1 mysql-community-server-client-debuginfo-5.6.43-45.1 mysql-community-server-debuginfo-5.6.43-45.1 mysql-community-server-debugsource-5.6.43-45.1 mysql-community-server-test-5.6.43-45.1 mysql-community-server-test-debuginfo-5.6.43-45.1 mysql-community-server-tools-5.6.43-45.1 mysql-community-server-tools-debuginfo-5.6.43-45.1 - openSUSE Leap 42.3 (x86_64): libmysql56client18-32bit-5.6.43-45.1 libmysql56client18-debuginfo-32bit-5.6.43-45.1 libmysql56client_r18-32bit-5.6.43-45.1 - openSUSE Leap 42.3 (noarch): mysql-community-server-errormessages-5.6.43-45.1 References: https://www.suse.com/security/cve/CVE-2018-0734.html https://www.suse.com/security/cve/CVE-2019-2455.html https://www.suse.com/security/cve/CVE-2019-2481.html https://www.suse.com/security/cve/CVE-2019-2482.html https://www.suse.com/security/cve/CVE-2019-2503.html https://www.suse.com/security/cve/CVE-2019-2507.html https://www.suse.com/security/cve/CVE-2019-2529.html https://www.suse.com/security/cve/CVE-2019-2531.html https://www.suse.com/security/cve/CVE-2019-2534.html https://www.suse.com/security/cve/CVE-2019-2537.html https://bugzilla.suse.com/1113652 https://bugzilla.suse.com/1122198 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0132-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 04 Feb '19

04 Feb '19

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0132-1 Rating: important References: #1122983 Cross-References: CVE-2018-18500 CVE-2018-18501 CVE-2018-18505 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for MozillaFirefox to version 60.5.0esr fixes the following issues: Security issues fixed: - CVE-2018-18500: Fixed a use-after-free parsing HTML5 stream (boo#1122983). - CVE-2018-18505: Fixed a privilege escalation through IPC channel messages (boo#1122983). - CVE-2018-18501: Fixed multiple memory safety bugs (boo#1122983). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-132=1 Package List: - openSUSE Leap 15.0 (x86_64): MozillaFirefox-60.5.0-lp150.3.36.1 MozillaFirefox-branding-upstream-60.5.0-lp150.3.36.1 MozillaFirefox-buildsymbols-60.5.0-lp150.3.36.1 MozillaFirefox-debuginfo-60.5.0-lp150.3.36.1 MozillaFirefox-debugsource-60.5.0-lp150.3.36.1 MozillaFirefox-devel-60.5.0-lp150.3.36.1 MozillaFirefox-translations-common-60.5.0-lp150.3.36.1 MozillaFirefox-translations-other-60.5.0-lp150.3.36.1 References: https://www.suse.com/security/cve/CVE-2018-18500.html https://www.suse.com/security/cve/CVE-2018-18501.html https://www.suse.com/security/cve/CVE-2018-18505.html https://bugzilla.suse.com/1122983 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0133-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 04 Feb '19

04 Feb '19

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0133-1 Rating: important References: #1121255 #1122983 Cross-References: CVE-2018-18500 CVE-2018-18501 CVE-2018-18505 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for MozillaFirefox, mozilla-nss fixes the following issues: Security issues fixed: - CVE-2018-18500: Fixed a use-after-free parsing HTML5 stream (boo#1122983). - CVE-2018-18505: Fixed a privilege escalation through IPC channel messages (boo#1122983). - CVE-2018-18501: Fixed multiple memory safety bugs (boo#1122983). Non-security issue fixed: - Update mozilla-nss to version 3.36.7 as build dependency. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-133=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libfreebl3-3.36.7-57.1 libfreebl3-debuginfo-3.36.7-57.1 libsoftokn3-3.36.7-57.1 libsoftokn3-debuginfo-3.36.7-57.1 mozilla-nss-3.36.7-57.1 mozilla-nss-certs-3.36.7-57.1 mozilla-nss-certs-debuginfo-3.36.7-57.1 mozilla-nss-debuginfo-3.36.7-57.1 mozilla-nss-debugsource-3.36.7-57.1 mozilla-nss-devel-3.36.7-57.1 mozilla-nss-sysinit-3.36.7-57.1 mozilla-nss-sysinit-debuginfo-3.36.7-57.1 mozilla-nss-tools-3.36.7-57.1 mozilla-nss-tools-debuginfo-3.36.7-57.1 - openSUSE Leap 42.3 (x86_64): MozillaFirefox-60.5.0-128.1 MozillaFirefox-branding-upstream-60.5.0-128.1 MozillaFirefox-buildsymbols-60.5.0-128.1 MozillaFirefox-debuginfo-60.5.0-128.1 MozillaFirefox-debugsource-60.5.0-128.1 MozillaFirefox-devel-60.5.0-128.1 MozillaFirefox-translations-common-60.5.0-128.1 MozillaFirefox-translations-other-60.5.0-128.1 libfreebl3-32bit-3.36.7-57.1 libfreebl3-debuginfo-32bit-3.36.7-57.1 libsoftokn3-32bit-3.36.7-57.1 libsoftokn3-debuginfo-32bit-3.36.7-57.1 mozilla-nss-32bit-3.36.7-57.1 mozilla-nss-certs-32bit-3.36.7-57.1 mozilla-nss-certs-debuginfo-32bit-3.36.7-57.1 mozilla-nss-debuginfo-32bit-3.36.7-57.1 mozilla-nss-sysinit-32bit-3.36.7-57.1 mozilla-nss-sysinit-debuginfo-32bit-3.36.7-57.1 References: https://www.suse.com/security/cve/CVE-2018-18500.html https://www.suse.com/security/cve/CVE-2018-18501.html https://www.suse.com/security/cve/CVE-2018-18505.html https://bugzilla.suse.com/1121255 https://bugzilla.suse.com/1122983 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0131-1: moderate: Security update for pdns-recursor
by opensuse-security＠opensuse.org 04 Feb '19

04 Feb '19

openSUSE Security Update: Security update for pdns-recursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0131-1 Rating: moderate References: #1121887 #1121889 Cross-References: CVE-2019-3806 CVE-2019-3807 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for pdns-recursor to version 4.1.10 fixes the following issues: Security issues fixed: - CVE-2019-3806: Fixed a case when Lua hooks are not called over TCP (boo#1121887) - CVE-2019-3807: Fixed an issue where DNSSEC validation was not performed for AA=0 responses (boo#1121889) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-131=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): pdns-recursor-4.1.10-16.1 References: https://www.suse.com/security/cve/CVE-2019-3806.html https://www.suse.com/security/cve/CVE-2019-3807.html https://bugzilla.suse.com/1121887 https://bugzilla.suse.com/1121889 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0129-1: important: Security update for python-paramiko
by opensuse-security＠opensuse.org 04 Feb '19

04 Feb '19

openSUSE Security Update: Security update for python-paramiko ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0129-1 Rating: important References: #1111151 #1115769 #1121846 Cross-References: CVE-2018-1000805 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for python-paramiko to version 2.4.2 fixes the following issues: Security issue fixed: - CVE-2018-1000805: Fixed an authentication bypass in auth_handler.py (bsc#1111151) Non-security issue fixed: - Disable experimental gssapi support (bsc#1115769) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-129=1 Package List: - openSUSE Leap 15.0 (noarch): python-paramiko-doc-2.4.2-lp150.2.3.1 python2-paramiko-2.4.2-lp150.2.3.1 python3-paramiko-2.4.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000805.html https://bugzilla.suse.com/1111151 https://bugzilla.suse.com/1115769 https://bugzilla.suse.com/1121846 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0128-1: moderate: Security update for avahi
by opensuse-security＠opensuse.org 04 Feb '19

04 Feb '19

openSUSE Security Update: Security update for avahi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0128-1 Rating: moderate References: #1120281 Cross-References: CVE-2018-1000845 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for avahi fixes the following issues: Security issue fixed: - CVE-2018-1000845: Fixed DNS amplification and reflection to spoofed addresses (DOS) (bsc#1120281) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-128=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): avahi-0.6.32-4.3.1 avahi-autoipd-0.6.32-4.3.1 avahi-autoipd-debuginfo-0.6.32-4.3.1 avahi-compat-howl-devel-0.6.32-4.3.1 avahi-compat-mDNSResponder-devel-0.6.32-4.3.1 avahi-debuginfo-0.6.32-4.3.1 avahi-debugsource-0.6.32-4.3.1 avahi-glib2-debugsource-0.6.32-4.3.1 avahi-qt4-debugsource-0.6.32-4.3.1 avahi-utils-0.6.32-4.3.1 avahi-utils-debuginfo-0.6.32-4.3.1 avahi-utils-gtk-0.6.32-4.3.1 avahi-utils-gtk-debuginfo-0.6.32-4.3.1 libavahi-client3-0.6.32-4.3.1 libavahi-client3-debuginfo-0.6.32-4.3.1 libavahi-common3-0.6.32-4.3.1 libavahi-common3-debuginfo-0.6.32-4.3.1 libavahi-core7-0.6.32-4.3.1 libavahi-core7-debuginfo-0.6.32-4.3.1 libavahi-devel-0.6.32-4.3.1 libavahi-glib-devel-0.6.32-4.3.1 libavahi-glib1-0.6.32-4.3.1 libavahi-glib1-debuginfo-0.6.32-4.3.1 libavahi-gobject-devel-0.6.32-4.3.1 libavahi-gobject0-0.6.32-4.3.1 libavahi-gobject0-debuginfo-0.6.32-4.3.1 libavahi-qt4-1-0.6.32-4.3.1 libavahi-qt4-1-debuginfo-0.6.32-4.3.1 libavahi-qt4-devel-0.6.32-4.3.1 libavahi-ui-gtk3-0-0.6.32-4.3.1 libavahi-ui-gtk3-0-debuginfo-0.6.32-4.3.1 libavahi-ui0-0.6.32-4.3.1 libavahi-ui0-debuginfo-0.6.32-4.3.1 libdns_sd-0.6.32-4.3.1 libdns_sd-debuginfo-0.6.32-4.3.1 libhowl0-0.6.32-4.3.1 libhowl0-debuginfo-0.6.32-4.3.1 python-avahi-0.6.32-4.3.1 python-avahi-gtk-0.6.32-4.3.1 typelib-1_0-Avahi-0_6-0.6.32-4.3.1 - openSUSE Leap 42.3 (noarch): avahi-lang-0.6.32-4.3.1 - openSUSE Leap 42.3 (x86_64): avahi-debuginfo-32bit-0.6.32-4.3.1 avahi-mono-0.6.32-4.3.1 libavahi-client3-32bit-0.6.32-4.3.1 libavahi-client3-debuginfo-32bit-0.6.32-4.3.1 libavahi-common3-32bit-0.6.32-4.3.1 libavahi-common3-debuginfo-32bit-0.6.32-4.3.1 libavahi-glib1-32bit-0.6.32-4.3.1 libavahi-glib1-debuginfo-32bit-0.6.32-4.3.1 libdns_sd-32bit-0.6.32-4.3.1 libdns_sd-debuginfo-32bit-0.6.32-4.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000845.html https://bugzilla.suse.com/1120281 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0