February 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:0268-1: important: Security update for systemd
by opensuse-security＠opensuse.org 28 Feb '19

28 Feb '19

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0268-1 Rating: important References: #1111498 #1117025 #1117382 #1120658 #1122000 #1122344 #1123333 #1123892 #1125352 Cross-References: CVE-2019-6454 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has 8 fixes is now available. Description: This update for systemd fixes the following issues: Security vulnerability fixed: - CVE-2019-6454: Fixed a crash of PID1 by sending specially crafted D-BUS message on the system bus by an unprivileged user (bsc#1125352) Other bug fixes and changes: - journal-remote: set a limit on the number of fields in a message - journal-remote: verify entry length from header - journald: set a limit on the number of fields (1k) - journald: do not store the iovec entry for process commandline on stack - core: include Found state in device dumps - device: fix serialization and deserialization of DeviceFound - fix path in btrfs rule (#6844) - assemble multidevice btrfs volumes without external tools (#6607) (bsc#1117025) - Update systemd-system.conf.xml (bsc#1122000) - units: inform user that the default target is started after exiting from rescue or emergency mode - manager: don't skip sigchld handler for main and control pid for services (#3738) - core: Add helper functions unit_{main, control}_pid - manager: Fixing a debug printf formatting mistake (#3640) - manager: Only invoke a single sigchld per unit within a cleanup cycle (bsc#1117382) - core: update invoke_sigchld_event() to handle NULL ->sigchld_event() - sd-event: expose the event loop iteration counter via sd_event_get_iteration() (#3631) - unit: rework a bit how we keep the service fdstore from being destroyed during service restart (bsc#1122344) - core: when restarting services, don't close fds - cryptsetup: Add dependency on loopback setup to generated units - journal-gateway: use localStorage["cursor"] only when it has valid value - journal-gateway: explicitly declare local variables - analyze: actually select longest activated-time of services - sd-bus: fix implicit downcast of bitfield reported by LGTM - core: free lines after reading them (bsc#1123892) - pam_systemd: reword message about not creating a session (bsc#1111498) - pam_systemd: suppress LOG_DEBUG log messages if debugging is off (bsc#1111498) - main: improve RLIMIT_NOFILE handling (#5795) (bsc#1120658) - sd-bus: if we receive an invalid dbus message, ignore and proceeed - automount: don't pass non-blocking pipe to kernel. - units: make sure initrd-cleanup.service terminates before switching to rootfs (bsc#1123333) - units: add Wants=initrd-cleanup.service to initrd-switch-root.target (#4345) (bsc#1123333) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-268=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libsystemd0-228-68.1 libsystemd0-debuginfo-228-68.1 libsystemd0-mini-228-68.1 libsystemd0-mini-debuginfo-228-68.1 libudev-devel-228-68.1 libudev-mini-devel-228-68.1 libudev-mini1-228-68.1 libudev-mini1-debuginfo-228-68.1 libudev1-228-68.1 libudev1-debuginfo-228-68.1 nss-myhostname-228-68.1 nss-myhostname-debuginfo-228-68.1 nss-mymachines-228-68.1 nss-mymachines-debuginfo-228-68.1 systemd-228-68.1 systemd-debuginfo-228-68.1 systemd-debugsource-228-68.1 systemd-devel-228-68.1 systemd-logger-228-68.1 systemd-mini-228-68.1 systemd-mini-debuginfo-228-68.1 systemd-mini-debugsource-228-68.1 systemd-mini-devel-228-68.1 systemd-mini-sysvinit-228-68.1 systemd-sysvinit-228-68.1 udev-228-68.1 udev-debuginfo-228-68.1 udev-mini-228-68.1 udev-mini-debuginfo-228-68.1 - openSUSE Leap 42.3 (x86_64): libsystemd0-32bit-228-68.1 libsystemd0-debuginfo-32bit-228-68.1 libudev1-32bit-228-68.1 libudev1-debuginfo-32bit-228-68.1 nss-myhostname-32bit-228-68.1 nss-myhostname-debuginfo-32bit-228-68.1 systemd-32bit-228-68.1 systemd-debuginfo-32bit-228-68.1 - openSUSE Leap 42.3 (noarch): systemd-bash-completion-228-68.1 systemd-mini-bash-completion-228-68.1 References: https://www.suse.com/security/cve/CVE-2019-6454.html https://bugzilla.suse.com/1111498 https://bugzilla.suse.com/1117025 https://bugzilla.suse.com/1117382 https://bugzilla.suse.com/1120658 https://bugzilla.suse.com/1122000 https://bugzilla.suse.com/1122344 https://bugzilla.suse.com/1123333 https://bugzilla.suse.com/1123892 https://bugzilla.suse.com/1125352 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0265-1: moderate: Security update for libqt5-qtbase
by opensuse-security＠opensuse.org 27 Feb '19

27 Feb '19

openSUSE Security Update: Security update for libqt5-qtbase ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0265-1 Rating: moderate References: #1096328 #1099874 #1108889 #1118595 #1118596 #1120639 Cross-References: CVE-2018-15518 CVE-2018-19873 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has four fixes is now available. Description: This update for libqt5-qtbase provides the following fixes: Security issues fixed: - CVE-2018-15518: Fixed double free in QXmlStreamReader (bsc#1118595) - CVE-2018-19873: Fixed Denial of Service on malformed BMP file in QBmpHandler (bsc#1118596) Non-security issues fixed: - Fix dynamic loading of libGL. (bsc#1099874) - Make sure printer settings are properly remembered. (bsc#1096328) - Add patch to fix fails to load pixmap cursors on XRender less system (bsc#1108889) - Fix krita pop-up palette not working properly (bsc#1120639) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-265=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libQt5Bootstrap-devel-static-5.9.4-lp150.5.4.1 libQt5Concurrent-devel-5.9.4-lp150.5.4.1 libQt5Concurrent5-5.9.4-lp150.5.4.1 libQt5Concurrent5-debuginfo-5.9.4-lp150.5.4.1 libQt5Core-devel-5.9.4-lp150.5.4.1 libQt5Core5-5.9.4-lp150.5.4.1 libQt5Core5-debuginfo-5.9.4-lp150.5.4.1 libQt5DBus-devel-5.9.4-lp150.5.4.1 libQt5DBus-devel-debuginfo-5.9.4-lp150.5.4.1 libQt5DBus5-5.9.4-lp150.5.4.1 libQt5DBus5-debuginfo-5.9.4-lp150.5.4.1 libQt5Gui-devel-5.9.4-lp150.5.4.1 libQt5Gui5-5.9.4-lp150.5.4.1 libQt5Gui5-debuginfo-5.9.4-lp150.5.4.1 libQt5KmsSupport-devel-static-5.9.4-lp150.5.4.1 libQt5Network-devel-5.9.4-lp150.5.4.1 libQt5Network5-5.9.4-lp150.5.4.1 libQt5Network5-debuginfo-5.9.4-lp150.5.4.1 libQt5OpenGL-devel-5.9.4-lp150.5.4.1 libQt5OpenGL5-5.9.4-lp150.5.4.1 libQt5OpenGL5-debuginfo-5.9.4-lp150.5.4.1 libQt5OpenGLExtensions-devel-static-5.9.4-lp150.5.4.1 libQt5PlatformHeaders-devel-5.9.4-lp150.5.4.1 libQt5PlatformSupport-devel-static-5.9.4-lp150.5.4.1 libQt5PrintSupport-devel-5.9.4-lp150.5.4.1 libQt5PrintSupport5-5.9.4-lp150.5.4.1 libQt5PrintSupport5-debuginfo-5.9.4-lp150.5.4.1 libQt5Sql-devel-5.9.4-lp150.5.4.1 libQt5Sql5-5.9.4-lp150.5.4.1 libQt5Sql5-debuginfo-5.9.4-lp150.5.4.1 libQt5Sql5-mysql-5.9.4-lp150.5.4.1 libQt5Sql5-mysql-debuginfo-5.9.4-lp150.5.4.1 libQt5Sql5-postgresql-5.9.4-lp150.5.4.1 libQt5Sql5-postgresql-debuginfo-5.9.4-lp150.5.4.1 libQt5Sql5-sqlite-5.9.4-lp150.5.4.1 libQt5Sql5-sqlite-debuginfo-5.9.4-lp150.5.4.1 libQt5Sql5-unixODBC-5.9.4-lp150.5.4.1 libQt5Sql5-unixODBC-debuginfo-5.9.4-lp150.5.4.1 libQt5Test-devel-5.9.4-lp150.5.4.1 libQt5Test5-5.9.4-lp150.5.4.1 libQt5Test5-debuginfo-5.9.4-lp150.5.4.1 libQt5Widgets-devel-5.9.4-lp150.5.4.1 libQt5Widgets5-5.9.4-lp150.5.4.1 libQt5Widgets5-debuginfo-5.9.4-lp150.5.4.1 libQt5Xml-devel-5.9.4-lp150.5.4.1 libQt5Xml5-5.9.4-lp150.5.4.1 libQt5Xml5-debuginfo-5.9.4-lp150.5.4.1 libqt5-qtbase-common-devel-5.9.4-lp150.5.4.1 libqt5-qtbase-common-devel-debuginfo-5.9.4-lp150.5.4.1 libqt5-qtbase-debugsource-5.9.4-lp150.5.4.1 libqt5-qtbase-devel-5.9.4-lp150.5.4.1 libqt5-qtbase-examples-5.9.4-lp150.5.4.1 libqt5-qtbase-examples-debuginfo-5.9.4-lp150.5.4.1 libqt5-qtbase-platformtheme-gtk3-5.9.4-lp150.5.4.1 libqt5-qtbase-platformtheme-gtk3-debuginfo-5.9.4-lp150.5.4.1 - openSUSE Leap 15.0 (x86_64): libQt5Bootstrap-devel-static-32bit-5.9.4-lp150.5.4.1 libQt5Concurrent-devel-32bit-5.9.4-lp150.5.4.1 libQt5Concurrent5-32bit-5.9.4-lp150.5.4.1 libQt5Concurrent5-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Core-devel-32bit-5.9.4-lp150.5.4.1 libQt5Core5-32bit-5.9.4-lp150.5.4.1 libQt5Core5-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5DBus-devel-32bit-5.9.4-lp150.5.4.1 libQt5DBus-devel-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5DBus5-32bit-5.9.4-lp150.5.4.1 libQt5DBus5-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Gui-devel-32bit-5.9.4-lp150.5.4.1 libQt5Gui5-32bit-5.9.4-lp150.5.4.1 libQt5Gui5-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Network-devel-32bit-5.9.4-lp150.5.4.1 libQt5Network5-32bit-5.9.4-lp150.5.4.1 libQt5Network5-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5OpenGL-devel-32bit-5.9.4-lp150.5.4.1 libQt5OpenGL5-32bit-5.9.4-lp150.5.4.1 libQt5OpenGL5-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5OpenGLExtensions-devel-static-32bit-5.9.4-lp150.5.4.1 libQt5PlatformSupport-devel-static-32bit-5.9.4-lp150.5.4.1 libQt5PrintSupport-devel-32bit-5.9.4-lp150.5.4.1 libQt5PrintSupport5-32bit-5.9.4-lp150.5.4.1 libQt5PrintSupport5-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Sql-devel-32bit-5.9.4-lp150.5.4.1 libQt5Sql5-32bit-5.9.4-lp150.5.4.1 libQt5Sql5-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Sql5-mysql-32bit-5.9.4-lp150.5.4.1 libQt5Sql5-mysql-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Sql5-postgresql-32bit-5.9.4-lp150.5.4.1 libQt5Sql5-postgresql-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Sql5-sqlite-32bit-5.9.4-lp150.5.4.1 libQt5Sql5-sqlite-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Sql5-unixODBC-32bit-5.9.4-lp150.5.4.1 libQt5Sql5-unixODBC-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Test-devel-32bit-5.9.4-lp150.5.4.1 libQt5Test5-32bit-5.9.4-lp150.5.4.1 libQt5Test5-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Widgets-devel-32bit-5.9.4-lp150.5.4.1 libQt5Widgets5-32bit-5.9.4-lp150.5.4.1 libQt5Widgets5-32bit-debuginfo-5.9.4-lp150.5.4.1 libQt5Xml-devel-32bit-5.9.4-lp150.5.4.1 libQt5Xml5-32bit-5.9.4-lp150.5.4.1 libQt5Xml5-32bit-debuginfo-5.9.4-lp150.5.4.1 libqt5-qtbase-examples-32bit-5.9.4-lp150.5.4.1 libqt5-qtbase-examples-32bit-debuginfo-5.9.4-lp150.5.4.1 - openSUSE Leap 15.0 (noarch): libQt5Core-private-headers-devel-5.9.4-lp150.5.4.1 libQt5DBus-private-headers-devel-5.9.4-lp150.5.4.1 libQt5Gui-private-headers-devel-5.9.4-lp150.5.4.1 libQt5KmsSupport-private-headers-devel-5.9.4-lp150.5.4.1 libQt5Network-private-headers-devel-5.9.4-lp150.5.4.1 libQt5OpenGL-private-headers-devel-5.9.4-lp150.5.4.1 libQt5PlatformSupport-private-headers-devel-5.9.4-lp150.5.4.1 libQt5PrintSupport-private-headers-devel-5.9.4-lp150.5.4.1 libQt5Sql-private-headers-devel-5.9.4-lp150.5.4.1 libQt5Test-private-headers-devel-5.9.4-lp150.5.4.1 libQt5Widgets-private-headers-devel-5.9.4-lp150.5.4.1 libqt5-qtbase-private-headers-devel-5.9.4-lp150.5.4.1 References: https://www.suse.com/security/cve/CVE-2018-15518.html https://www.suse.com/security/cve/CVE-2018-19873.html https://bugzilla.suse.com/1096328 https://bugzilla.suse.com/1099874 https://bugzilla.suse.com/1108889 https://bugzilla.suse.com/1118595 https://bugzilla.suse.com/1118596 https://bugzilla.suse.com/1120639 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0254-1: important: Security update for qemu
by opensuse-security＠opensuse.org 27 Feb '19

27 Feb '19

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0254-1 Rating: important References: #1063993 #1079730 #1100408 #1101982 #1112646 #1114957 #1116717 #1117275 #1119493 #1121600 #1123156 #1123179 Cross-References: CVE-2018-16872 CVE-2018-18954 CVE-2018-19364 CVE-2018-19489 CVE-2019-6778 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has 7 fixes is now available. Description: This update for qemu fixes the following issues: Security issues fixed: - CVE-2019-6778: Fixed a heap buffer overflow issue in the SLiRP networking implementation (bsc#1123156). - CVE-2018-16872: Fixed a host security vulnerability related to handling symlinks in usb-mtp (bsc#1119493). - CVE-2018-19489: Fixed a denial of service vulnerability in virtfs (bsc#1117275). - CVE-2018-19364: Fixed a use-after-free if the virtfs interface resulting in a denial of service (bsc#1116717). - CVE-2018-18954: Fixed a denial of service vulnerability related to PowerPC PowerNV memory operations (bsc#1114957). Non-security issues fixed: - Improved disk performance for qemu on xen (bsc#1100408). - Fixed xen offline migration (bsc#1079730, bsc#1101982, bsc#1063993). - Fixed pwrite64/pread64/write to return 0 over -1 for a zero length NULL buffer in qemu (bsc#1121600). - Use /bin/bash to echo value into sys fs for ksm control (bsc#1112646). - Return specification exception for unimplemented diag 308 subcodes rather than a hardware error (bsc#1123179). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-254=1 Package List: - openSUSE Leap 15.0 (noarch): qemu-ipxe-1.0.0+-lp150.7.18.1 qemu-seabios-1.11.0-lp150.7.18.1 qemu-sgabios-8-lp150.7.18.1 qemu-vgabios-1.11.0-lp150.7.18.1 - openSUSE Leap 15.0 (x86_64): qemu-2.11.2-lp150.7.18.1 qemu-arm-2.11.2-lp150.7.18.1 qemu-arm-debuginfo-2.11.2-lp150.7.18.1 qemu-block-curl-2.11.2-lp150.7.18.1 qemu-block-curl-debuginfo-2.11.2-lp150.7.18.1 qemu-block-dmg-2.11.2-lp150.7.18.1 qemu-block-dmg-debuginfo-2.11.2-lp150.7.18.1 qemu-block-gluster-2.11.2-lp150.7.18.1 qemu-block-gluster-debuginfo-2.11.2-lp150.7.18.1 qemu-block-iscsi-2.11.2-lp150.7.18.1 qemu-block-iscsi-debuginfo-2.11.2-lp150.7.18.1 qemu-block-rbd-2.11.2-lp150.7.18.1 qemu-block-rbd-debuginfo-2.11.2-lp150.7.18.1 qemu-block-ssh-2.11.2-lp150.7.18.1 qemu-block-ssh-debuginfo-2.11.2-lp150.7.18.1 qemu-debuginfo-2.11.2-lp150.7.18.1 qemu-debugsource-2.11.2-lp150.7.18.1 qemu-extra-2.11.2-lp150.7.18.1 qemu-extra-debuginfo-2.11.2-lp150.7.18.1 qemu-guest-agent-2.11.2-lp150.7.18.1 qemu-guest-agent-debuginfo-2.11.2-lp150.7.18.1 qemu-ksm-2.11.2-lp150.7.18.1 qemu-kvm-2.11.2-lp150.7.18.1 qemu-lang-2.11.2-lp150.7.18.1 qemu-linux-user-2.11.2-lp150.7.18.1 qemu-linux-user-debuginfo-2.11.2-lp150.7.18.1 qemu-linux-user-debugsource-2.11.2-lp150.7.18.1 qemu-ppc-2.11.2-lp150.7.18.1 qemu-ppc-debuginfo-2.11.2-lp150.7.18.1 qemu-s390-2.11.2-lp150.7.18.1 qemu-s390-debuginfo-2.11.2-lp150.7.18.1 qemu-testsuite-2.11.2-lp150.7.18.1 qemu-tools-2.11.2-lp150.7.18.1 qemu-tools-debuginfo-2.11.2-lp150.7.18.1 qemu-x86-2.11.2-lp150.7.18.1 qemu-x86-debuginfo-2.11.2-lp150.7.18.1 References: https://www.suse.com/security/cve/CVE-2018-16872.html https://www.suse.com/security/cve/CVE-2018-18954.html https://www.suse.com/security/cve/CVE-2018-19364.html https://www.suse.com/security/cve/CVE-2018-19489.html https://www.suse.com/security/cve/CVE-2019-6778.html https://bugzilla.suse.com/1063993 https://bugzilla.suse.com/1079730 https://bugzilla.suse.com/1100408 https://bugzilla.suse.com/1101982 https://bugzilla.suse.com/1112646 https://bugzilla.suse.com/1114957 https://bugzilla.suse.com/1116717 https://bugzilla.suse.com/1117275 https://bugzilla.suse.com/1119493 https://bugzilla.suse.com/1121600 https://bugzilla.suse.com/1123156 https://bugzilla.suse.com/1123179 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0261-1: important: Security update for gvfs
by opensuse-security＠opensuse.org 27 Feb '19

27 Feb '19

openSUSE Security Update: Security update for gvfs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0261-1 Rating: important References: #1125084 Cross-References: CVE-2019-3827 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gvfs fixes the following issues: Security vulnerability fixed: - CVE-2019-3827: Fixed an issue whereby an unprivileged user was not prompted to give a password when acessing root owned files. (bsc#1125084) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-261=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): gvfs-1.34.2.1-lp150.3.6.1 gvfs-backend-afc-1.34.2.1-lp150.3.6.1 gvfs-backend-afc-debuginfo-1.34.2.1-lp150.3.6.1 gvfs-backend-samba-1.34.2.1-lp150.3.6.1 gvfs-backend-samba-debuginfo-1.34.2.1-lp150.3.6.1 gvfs-backends-1.34.2.1-lp150.3.6.1 gvfs-backends-debuginfo-1.34.2.1-lp150.3.6.1 gvfs-debuginfo-1.34.2.1-lp150.3.6.1 gvfs-debugsource-1.34.2.1-lp150.3.6.1 gvfs-devel-1.34.2.1-lp150.3.6.1 gvfs-fuse-1.34.2.1-lp150.3.6.1 gvfs-fuse-debuginfo-1.34.2.1-lp150.3.6.1 - openSUSE Leap 15.0 (noarch): gvfs-lang-1.34.2.1-lp150.3.6.1 - openSUSE Leap 15.0 (x86_64): gvfs-32bit-1.34.2.1-lp150.3.6.1 gvfs-32bit-debuginfo-1.34.2.1-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-3827.html https://bugzilla.suse.com/1125084 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0252-1: important: Security update for docker-runc
by opensuse-security＠opensuse.org 27 Feb '19

27 Feb '19

openSUSE Security Update: Security update for docker-runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0252-1 Rating: important References: #1121967 Cross-References: CVE-2019-5736 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for docker-runc fixes the following issues: Security issue fixed: - CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-252=1 Package List: - openSUSE Leap 15.0 (noarch): docker-runc-test-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.7.1 - openSUSE Leap 15.0 (x86_64): docker-runc-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.7.1 docker-runc-debuginfo-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.7.1 References: https://www.suse.com/security/cve/CVE-2019-5736.html https://bugzilla.suse.com/1121967 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0255-1: important: Security update for systemd
by opensuse-security＠opensuse.org 27 Feb '19

27 Feb '19

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0255-1 Rating: important References: #1117025 #1121563 #1122000 #1123333 #1123727 #1123892 #1124153 #1125352 Cross-References: CVE-2019-6454 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has 7 fixes is now available. Description: This update for systemd fixes the following issues: - CVE-2019-6454: Overlong DBUS messages could be used to crash systemd (bsc#1125352) - units: make sure initrd-cleanup.service terminates before switching to rootfs (bsc#1123333) - logind: fix bad error propagation - login: log session state "closing" (as well as New/Removed) - logind: fix borked r check - login: don't remove all devices from PID1 when only one was removed - login: we only allow opening character devices - login: correct comment in session_device_free() - login: remember that fds received from PID1 need to be removed eventually - login: fix FDNAME in call to sd_pid_notify_with_fds() - logind: fd 0 is a valid fd - logind: rework sd_eviocrevoke() - logind: check file is device node before using .st_rdev - logind: use the new FDSTOREREMOVE=1 sd_notify() message (bsc#1124153) - core: add a new sd_notify() message for removing fds from the FD store again - logind: make sure we don't trip up on half-initialized session devices (bsc#1123727) - fd-util: accept that kcmp might fail with EPERM/EACCES - core: Fix use after free case in load_from_path() (bsc#1121563) - core: include Found state in device dumps - device: fix serialization and deserialization of DeviceFound - fix path in btrfs rule (#6844) - assemble multidevice btrfs volumes without external tools (#6607) (bsc#1117025) - Update systemd-system.conf.xml (bsc#1122000) - units: inform user that the default target is started after exiting from rescue or emergency mode - core: free lines after reading them (bsc#1123892) - sd-bus: if we receive an invalid dbus message, ignore and proceeed - automount: don't pass non-blocking pipe to kernel. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-255=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libsystemd0-234-lp150.20.15.1 libsystemd0-debuginfo-234-lp150.20.15.1 libsystemd0-mini-234-lp150.20.15.1 libsystemd0-mini-debuginfo-234-lp150.20.15.1 libudev-devel-234-lp150.20.15.1 libudev-mini-devel-234-lp150.20.15.1 libudev-mini1-234-lp150.20.15.1 libudev-mini1-debuginfo-234-lp150.20.15.1 libudev1-234-lp150.20.15.1 libudev1-debuginfo-234-lp150.20.15.1 nss-myhostname-234-lp150.20.15.1 nss-myhostname-debuginfo-234-lp150.20.15.1 nss-mymachines-234-lp150.20.15.1 nss-mymachines-debuginfo-234-lp150.20.15.1 nss-systemd-234-lp150.20.15.1 nss-systemd-debuginfo-234-lp150.20.15.1 systemd-234-lp150.20.15.1 systemd-container-234-lp150.20.15.1 systemd-container-debuginfo-234-lp150.20.15.1 systemd-coredump-234-lp150.20.15.1 systemd-coredump-debuginfo-234-lp150.20.15.1 systemd-debuginfo-234-lp150.20.15.1 systemd-debugsource-234-lp150.20.15.1 systemd-devel-234-lp150.20.15.1 systemd-logger-234-lp150.20.15.1 systemd-mini-234-lp150.20.15.1 systemd-mini-container-mini-234-lp150.20.15.1 systemd-mini-container-mini-debuginfo-234-lp150.20.15.1 systemd-mini-coredump-mini-234-lp150.20.15.1 systemd-mini-coredump-mini-debuginfo-234-lp150.20.15.1 systemd-mini-debuginfo-234-lp150.20.15.1 systemd-mini-debugsource-234-lp150.20.15.1 systemd-mini-devel-234-lp150.20.15.1 systemd-mini-sysvinit-234-lp150.20.15.1 systemd-sysvinit-234-lp150.20.15.1 udev-234-lp150.20.15.1 udev-debuginfo-234-lp150.20.15.1 udev-mini-234-lp150.20.15.1 udev-mini-debuginfo-234-lp150.20.15.1 - openSUSE Leap 15.0 (noarch): systemd-bash-completion-234-lp150.20.15.1 systemd-mini-bash-completion-234-lp150.20.15.1 - openSUSE Leap 15.0 (x86_64): libsystemd0-32bit-234-lp150.20.15.1 libsystemd0-32bit-debuginfo-234-lp150.20.15.1 libudev-devel-32bit-234-lp150.20.15.1 libudev1-32bit-234-lp150.20.15.1 libudev1-32bit-debuginfo-234-lp150.20.15.1 nss-myhostname-32bit-234-lp150.20.15.1 nss-myhostname-32bit-debuginfo-234-lp150.20.15.1 nss-mymachines-32bit-234-lp150.20.15.1 nss-mymachines-32bit-debuginfo-234-lp150.20.15.1 systemd-32bit-234-lp150.20.15.1 systemd-32bit-debuginfo-234-lp150.20.15.1 References: https://www.suse.com/security/cve/CVE-2019-6454.html https://bugzilla.suse.com/1117025 https://bugzilla.suse.com/1121563 https://bugzilla.suse.com/1122000 https://bugzilla.suse.com/1123333 https://bugzilla.suse.com/1123727 https://bugzilla.suse.com/1123892 https://bugzilla.suse.com/1124153 https://bugzilla.suse.com/1125352 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0251-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 27 Feb '19

27 Feb '19

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0251-1 Rating: important References: #1119105 #1122983 #1125330 Cross-References: CVE-2016-5824 CVE-2018-12405 CVE-2018-17466 CVE-2018-18335 CVE-2018-18356 CVE-2018-18492 CVE-2018-18493 CVE-2018-18494 CVE-2018-18498 CVE-2018-18500 CVE-2018-18501 CVE-2018-18505 CVE-2018-18509 CVE-2019-5785 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 60.5.1 fixes the following issues: Security vulnerabilities addressed (MSFA 2019-03 MSFA 2018-31 MFSA 2019-06 bsc#1122983 bsc#1119105 bsc#1125330): - CVE-2018-18356: Fixed a Use-after-free in Skia. - CVE-2019-5785: Fixed an Integer overflow in Skia. - CVE-2018-18335: Fixed a Buffer overflow in Skia by default deactivating Canvas 2D. This issue does not affect Linuc distributions. - CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures showing mistekenly that emails bring a valid sugnature. - CVE-2018-18500: Use-after-free parsing HTML5 stream - CVE-2018-18505: Privilege escalation through IPC channel messages - CVE-2016-5824 DoS (use-after-free) via a crafted ics file - CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 - CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11 - CVE-2018-18492: Use-after-free with select element - CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia - CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs - CVE-2018-18498: Integer overflow when calculating buffer sizes for images - CVE-2018-12405: Memory safety bugs fixed in Firefox 64, 60.4, and Thunderbird 60.4 Other bug fixes and changes: - FileLink provider WeTransfer to upload large attachments - Thunderbird now allows the addition of OpenSearch search engines from a local XML file using a minimal user interface: [+] button to select a file an add, [-] to remove. - More search engines: Google and DuckDuckGo available by default in some locales - During account creation, Thunderbird will now detect servers using the Microsoft Exchange protocol. It will offer the installation of a 3rd party add-on (Owl) which supports that protocol. - Thunderbird now compatible with other WebExtension-based FileLink add-ons like the Dropbox add-on - New WebExtensions FileLink API to facilitate add-ons - Fix decoding problems for messages with less common charsets (cp932, cp936) - New messages in the drafts folder (and other special or virtual folders) will no longer be included in the new messages notification - Thunderbird 60 will migrate security databases (key3.db, cert8.db to key4.db, cert9.db). - Address book search and auto-complete slowness - Plain text markup with * for bold, / for italics, _ for underline and | for code did not work when the enclosed text contained non-ASCII characters - While composing a message, a link not removed when link location was removed in the link properties panel - Encoding problems when exporting address books or messages using the system charset. Messages are now always exported using the UTF-8 encoding - If the "Date" header of a message was invalid, Jan 1970 or Dec 1969 was displayed. Now using date from "Received" header instead. - Body search/filtering didn't reliably ignore content of tags - Inappropriate warning "Thunderbird prevented the site (addons.thunderbird.net) from asking you to install software on your computer" when installing add-ons - Incorrect display of correspondents column since own email address was not always detected - Spurious 
 (encoded newline) inserted into drafts and sent email - Double-clicking on a word in the Write window sometimes launched the Advanced Property Editor or Link Properties dialog - Fixed Cookie removal - "Download rest of message" was not working if global inbox was used - Fix Encoding problems for users (especially in Poland) when a file was sent via a folder using "Sent to > Mail recipient" due to a problem in the Thunderbird MAPI interface - According to RFC 4616 and RFC 5721, passwords containing non-ASCII characters are encoded using UTF-8 which can lead to problems with non-compliant providers, for example office365.com. The SMTP LOGIN and POP3 USER/PASS authentication methods are now using a Latin-1 encoding again to work around this issue - Fix shutdown crash/hang after entering an empty IMAP password This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-251=1 Package List: - openSUSE Leap 15.0 (x86_64): MozillaThunderbird-60.5.1-lp150.3.30.1 MozillaThunderbird-buildsymbols-60.5.1-lp150.3.30.1 MozillaThunderbird-debuginfo-60.5.1-lp150.3.30.1 MozillaThunderbird-debugsource-60.5.1-lp150.3.30.1 MozillaThunderbird-translations-common-60.5.1-lp150.3.30.1 MozillaThunderbird-translations-other-60.5.1-lp150.3.30.1 References: https://www.suse.com/security/cve/CVE-2016-5824.html https://www.suse.com/security/cve/CVE-2018-12405.html https://www.suse.com/security/cve/CVE-2018-17466.html https://www.suse.com/security/cve/CVE-2018-18335.html https://www.suse.com/security/cve/CVE-2018-18356.html https://www.suse.com/security/cve/CVE-2018-18492.html https://www.suse.com/security/cve/CVE-2018-18493.html https://www.suse.com/security/cve/CVE-2018-18494.html https://www.suse.com/security/cve/CVE-2018-18498.html https://www.suse.com/security/cve/CVE-2018-18500.html https://www.suse.com/security/cve/CVE-2018-18501.html https://www.suse.com/security/cve/CVE-2018-18505.html https://www.suse.com/security/cve/CVE-2018-18509.html https://www.suse.com/security/cve/CVE-2019-5785.html https://bugzilla.suse.com/1119105 https://bugzilla.suse.com/1122983 https://bugzilla.suse.com/1125330 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0249-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 26 Feb '19

26 Feb '19

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0249-1 Rating: important References: #1122983 #1125330 Cross-References: CVE-2016-5824 CVE-2018-12405 CVE-2018-17466 CVE-2018-18335 CVE-2018-18356 CVE-2018-18492 CVE-2018-18493 CVE-2018-18494 CVE-2018-18498 CVE-2018-18500 CVE-2018-18501 CVE-2018-18505 CVE-2018-18509 CVE-2019-5785 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 60.5.1 fixes the following issues: Security vulnerabilities addressed (MFSA 2019-03 MFSA 2018-31 bsc#1122983 and MFSA 2019-06 bsc#1125330): - CVE-2018-18356: Fixed a Use-after-free in Skia. - CVE-2019-5785: Fixed an Integer overflow in Skia. - CVE-2018-18335: Fixed a Buffer overflow in Skia by default deactivating Canvas 2D. This issue does not affect Linuc distributions. - CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures showing mistekenly that emails bring a valid sugnature. - CVE-2018-18500: Use-after-free parsing HTML5 stream - CVE-2018-18505: Privilege escalation through IPC channel messages - CVE-2016-5824: DoS (use-after-free) via a crafted ics file - CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 - CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11 - CVE-2018-18492: Use-after-free with select element - CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia - CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs - CVE-2018-18498: Integer overflow when calculating buffer sizes for images - CVE-2018-12405: Memory safety bugs Other bug fixes and changes: * FileLink provider WeTransfer to upload large attachments * Thunderbird now allows the addition of OpenSearch search engines from a local XML file using a minimal user inferface: [+] button to select a file an add, [-] to remove. * More search engines: Google and DuckDuckGo available by default in some locales * During account creation, Thunderbird will now detect servers using the Microsoft Exchange protocol. It will offer the installation of a 3rd party add-on (Owl) which supports that protocol. * Thunderbird now compatible with other WebExtension-based FileLink add-ons like the Dropbox add-on * New WebExtensions FileLink API to facilitate add-ons * Fix decoding problems for messages with less common charsets (cp932, cp936) * New messages in the drafts folder (and other special or virtual folders) will no longer be included in the new messages notification * Thunderbird 60 will migrate security databases (key3.db, cert8.db to key4.db, cert9.db). Thunderbird 60.3.2 and earlier contained a fault that potentially deleted saved passwords and private certificate keys for users using a master password. Version 60.3.3 will prevent the loss of data; affected users who have already upgraded to version 60.3.2 or earlier can restore the deleted key3.db file from backup to complete the migration. * Address book search and auto-complete slowness introduced in Thunderbird 60.3.2 * Plain text markup with * for bold, / for italics, _ for underline and | for code did not work when the enclosed text contained non-ASCII characters * While composing a message, a link not removed when link location was removed in the link properties panel * Encoding problems when exporting address books or messages using the system charset. Messages are now always exported using the UTF-8 encoding * If the "Date" header of a message was invalid, Jan 1970 or Dec 1969 was displayed. Now using date from "Received" header instead. * Body search/filtering didn't reliably ignore content of tags * Inappropriate warning "Thunderbird prevented the site (addons.thunderbird.net) from asking you to install software on your computer" when installing add-ons * Incorrect display of correspondents column since own email address was not always detected * Spurious 
 (encoded newline) inserted into drafts and sent email * Double-clicking on a word in the Write window sometimes launched the Advanced Property Editor or Link Properties dialog * Fixe Cookie removal * "Download rest of message" was not working if global inbox was used * Fix Encoding problems for users (especially in Poland) when a file was sent via a folder using "Sent to > Mail recipient" due to a problem in the Thunderbird MAPI interface * According to RFC 4616 and RFC 5721, passwords containing non-ASCII characters are encoded using UTF-8 which can lead to problems with non-compliant providers, for example office365.com. The SMTP LOGIN and POP3 USER/PASS authentication methods are now using a Latin-1 encoding again to work around this issue * Fix shutdown crash/hang after entering an empty IMAP password Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-249=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-60.5.1-79.1 MozillaThunderbird-buildsymbols-60.5.1-79.1 MozillaThunderbird-translations-common-60.5.1-79.1 MozillaThunderbird-translations-other-60.5.1-79.1 References: https://www.suse.com/security/cve/CVE-2016-5824.html https://www.suse.com/security/cve/CVE-2018-12405.html https://www.suse.com/security/cve/CVE-2018-17466.html https://www.suse.com/security/cve/CVE-2018-18335.html https://www.suse.com/security/cve/CVE-2018-18356.html https://www.suse.com/security/cve/CVE-2018-18492.html https://www.suse.com/security/cve/CVE-2018-18493.html https://www.suse.com/security/cve/CVE-2018-18494.html https://www.suse.com/security/cve/CVE-2018-18498.html https://www.suse.com/security/cve/CVE-2018-18500.html https://www.suse.com/security/cve/CVE-2018-18501.html https://www.suse.com/security/cve/CVE-2018-18505.html https://www.suse.com/security/cve/CVE-2018-18509.html https://www.suse.com/security/cve/CVE-2019-5785.html https://bugzilla.suse.com/1122983 https://bugzilla.suse.com/1125330 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0248-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 26 Feb '19

26 Feb '19

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0248-1 Rating: important References: #1125330 Cross-References: CVE-2018-18356 CVE-2019-5785 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for MozillaFirefox to version 60.5.1esr fixes the following issues: Security vulnerabilities addressed (MFSA-2019-05, boo#1125330): - CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library that could occur when creating a path, leading to a potentially exploitable crash. - CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library that could occur after specific transform operations, leading to a potentially exploitable crash. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-248=1 Package List: - openSUSE Leap 15.0 (x86_64): MozillaFirefox-60.5.1-lp150.3.39.2 MozillaFirefox-branding-upstream-60.5.1-lp150.3.39.2 MozillaFirefox-buildsymbols-60.5.1-lp150.3.39.2 MozillaFirefox-debuginfo-60.5.1-lp150.3.39.2 MozillaFirefox-debugsource-60.5.1-lp150.3.39.2 MozillaFirefox-devel-60.5.1-lp150.3.39.2 MozillaFirefox-translations-common-60.5.1-lp150.3.39.2 MozillaFirefox-translations-other-60.5.1-lp150.3.39.2 References: https://www.suse.com/security/cve/CVE-2018-18356.html https://www.suse.com/security/cve/CVE-2019-5785.html https://bugzilla.suse.com/1125330 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0250-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 26 Feb '19

26 Feb '19

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0250-1 Rating: important References: #1125330 Cross-References: CVE-2018-18335 CVE-2018-18356 CVE-2018-18509 CVE-2019-5785 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for MozillaThunderbird to version 60.5.1 fixes the following issues: Security issues fixed (MFSA 2019-06 bsc#1125330): - CVE-2018-18356: Fixed a Use-after-free in Skia. - CVE-2019-5785: Fixed an Integer overflow in Skia. - CVE-2018-18335: Fixed a Buffer overflow in Skia by default deactivating Canvas 2D. This issue does not affect Linuc distributions. - CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures showing mistekenly that emails bring a valid sugnature. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-250=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaThunderbird-60.5.1-86.1 MozillaThunderbird-buildsymbols-60.5.1-86.1 MozillaThunderbird-debuginfo-60.5.1-86.1 MozillaThunderbird-debugsource-60.5.1-86.1 MozillaThunderbird-translations-common-60.5.1-86.1 MozillaThunderbird-translations-other-60.5.1-86.1 References: https://www.suse.com/security/cve/CVE-2018-18335.html https://www.suse.com/security/cve/CVE-2018-18356.html https://www.suse.com/security/cve/CVE-2018-18509.html https://www.suse.com/security/cve/CVE-2019-5785.html https://bugzilla.suse.com/1125330 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0247-1: moderate: Security update for kauth
by opensuse-security＠opensuse.org 26 Feb '19

26 Feb '19

openSUSE Security Update: Security update for kauth ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0247-1 Rating: moderate References: #1124863 Cross-References: CVE-2019-7443 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kauth fixes the following issues: Security issue fixed: - CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants (bsc#1124863). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-247=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): kauth-devel-5.45.0-bp150.3.6.1 libKF5Auth5-5.45.0-bp150.3.6.1 - openSUSE Backports SLE-15 (aarch64_ilp32): kauth-devel-64bit-5.45.0-bp150.3.6.1 libKF5Auth5-64bit-5.45.0-bp150.3.6.1 - openSUSE Backports SLE-15 (noarch): libKF5Auth5-lang-5.45.0-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-7443.html https://bugzilla.suse.com/1124863 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0242-1: moderate: Security update for kauth
by opensuse-security＠opensuse.org 25 Feb '19

25 Feb '19

openSUSE Security Update: Security update for kauth ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0242-1 Rating: moderate References: #1124863 Cross-References: CVE-2019-7443 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kauth fixes the following issues: Security issue fixed: - CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants (bsc#1124863). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-242=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-242=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-242=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-242=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): kauth-debugsource-5.32.0-3.3.1 kauth-devel-5.32.0-3.3.1 libKF5Auth5-5.32.0-3.3.1 libKF5Auth5-debuginfo-5.32.0-3.3.1 - openSUSE Leap 42.3 (noarch): libKF5Auth5-lang-5.32.0-3.3.1 - openSUSE Leap 42.3 (x86_64): kauth-devel-32bit-5.32.0-3.3.1 libKF5Auth5-32bit-5.32.0-3.3.1 libKF5Auth5-debuginfo-32bit-5.32.0-3.3.1 - openSUSE Leap 15.0 (i586 x86_64): kauth-debugsource-5.45.0-lp150.3.3.1 kauth-devel-5.45.0-lp150.3.3.1 libKF5Auth5-5.45.0-lp150.3.3.1 libKF5Auth5-debuginfo-5.45.0-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): libKF5Auth5-lang-5.45.0-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): kauth-devel-32bit-5.45.0-lp150.3.3.1 libKF5Auth5-32bit-5.45.0-lp150.3.3.1 libKF5Auth5-32bit-debuginfo-5.45.0-lp150.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): kauth-debugsource-5.45.0-bp150.3.3.1 kauth-devel-5.45.0-bp150.3.3.1 libKF5Auth5-5.45.0-bp150.3.3.1 libKF5Auth5-debuginfo-5.45.0-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): kauth-devel-64bit-5.45.0-bp150.3.3.1 libKF5Auth5-64bit-5.45.0-bp150.3.3.1 libKF5Auth5-64bit-debuginfo-5.45.0-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): libKF5Auth5-lang-5.45.0-bp150.3.3.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): kcoreaddons-5.20.0-8.1 kcoreaddons-5.32.0-7.1 kcoreaddons-debugsource-5.20.0-8.1 kcoreaddons-debugsource-5.32.0-7.1 kcoreaddons-devel-5.20.0-8.1 kcoreaddons-devel-5.32.0-7.1 kcoreaddons-devel-debuginfo-5.20.0-8.1 kcoreaddons-devel-debuginfo-5.32.0-7.1 libKF5CoreAddons5-5.20.0-8.1 libKF5CoreAddons5-5.32.0-7.1 libKF5CoreAddons5-debuginfo-5.20.0-8.1 libKF5CoreAddons5-debuginfo-5.32.0-7.1 libpolkit-qt5-1-1-0.112.0-4.1 libpolkit-qt5-1-1-0.112.0-5.1 libpolkit-qt5-1-1-debuginfo-0.112.0-4.1 libpolkit-qt5-1-1-debuginfo-0.112.0-5.1 libpolkit-qt5-1-devel-0.112.0-4.1 libpolkit-qt5-1-devel-0.112.0-5.1 polkit-qt5-1-debugsource-0.112.0-4.1 polkit-qt5-1-debugsource-0.112.0-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le x86_64): libpolkit-qt5-1-1-0.112.0-2.1 libpolkit-qt5-1-1-debuginfo-0.112.0-2.1 libpolkit-qt5-1-devel-0.112.0-2.1 polkit-qt5-1-debugsource-0.112.0-2.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le): kcoreaddons-5.26.0-5.2 kcoreaddons-debugsource-5.26.0-5.2 kcoreaddons-devel-5.26.0-5.2 kcoreaddons-devel-debuginfo-5.26.0-5.2 libKF5CoreAddons5-5.26.0-5.2 libKF5CoreAddons5-debuginfo-5.26.0-5.2 - SUSE Package Hub for SUSE Linux Enterprise 12 (ppc64le x86_64): kauth-debugsource-5.26.0-9.2 kauth-debugsource-5.32.0-5.1 kauth-devel-5.20.0-10.1 kauth-devel-5.26.0-9.2 kauth-devel-5.32.0-5.1 libKF5Auth5-5.20.0-10.1 libKF5Auth5-5.26.0-9.2 libKF5Auth5-5.32.0-5.1 libKF5Auth5-debuginfo-5.26.0-9.2 libKF5Auth5-debuginfo-5.32.0-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64_ilp32): kauth-devel-64bit-5.32.0-5.2 kcoreaddons-devel-64bit-5.32.0-7.1 kcoreaddons-devel-debuginfo-64bit-5.32.0-7.1 libKF5Auth5-64bit-5.32.0-5.2 libKF5Auth5-debuginfo-64bit-5.32.0-5.2 libKF5CoreAddons5-64bit-5.32.0-7.1 libKF5CoreAddons5-debuginfo-64bit-5.32.0-7.1 libpolkit-qt5-1-1-64bit-0.112.0-4.1 libpolkit-qt5-1-1-debuginfo-64bit-0.112.0-4.1 libpolkit-qt5-1-devel-64bit-0.112.0-4.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 s390x): kauth-debugsource-5.26.0-9.3 kauth-debugsource-5.32.0-5.2 kauth-devel-5.20.0-10.2 kauth-devel-5.26.0-9.3 kauth-devel-5.32.0-5.2 libKF5Auth5-5.20.0-10.2 libKF5Auth5-5.26.0-9.3 libKF5Auth5-5.32.0-5.2 libKF5Auth5-debuginfo-5.26.0-9.3 libKF5Auth5-debuginfo-5.32.0-5.2 - SUSE Package Hub for SUSE Linux Enterprise 12 (s390x x86_64): kcoreaddons-5.26.0-5.4 kcoreaddons-debugsource-5.26.0-5.4 kcoreaddons-devel-5.26.0-5.4 kcoreaddons-devel-debuginfo-5.26.0-5.4 libKF5CoreAddons5-5.26.0-5.4 libKF5CoreAddons5-debuginfo-5.26.0-5.4 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): kcoreaddons-lang-5.20.0-8.1 kcoreaddons-lang-5.26.0-5.2 kcoreaddons-lang-5.26.0-5.4 kcoreaddons-lang-5.32.0-7.1 libKF5Auth5-lang-5.20.0-10.1 libKF5Auth5-lang-5.20.0-10.2 libKF5Auth5-lang-5.26.0-9.2 libKF5Auth5-lang-5.26.0-9.3 libKF5Auth5-lang-5.32.0-5.1 libKF5Auth5-lang-5.32.0-5.2 - SUSE Package Hub for SUSE Linux Enterprise 12 (s390x): libpolkit-qt5-1-1-0.112.0-2.2 libpolkit-qt5-1-1-debuginfo-0.112.0-2.2 libpolkit-qt5-1-devel-0.112.0-2.2 polkit-qt5-1-debugsource-0.112.0-2.2 References: https://www.suse.com/security/cve/CVE-2019-7443.html https://bugzilla.suse.com/1124863 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0244-1: moderate: Security update for python-Jinja2
by opensuse-security＠opensuse.org 25 Feb '19

25 Feb '19

openSUSE Security Update: Security update for python-Jinja2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0244-1 Rating: moderate References: #858239 Cross-References: CVE-2014-0012 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Jinja2 fixes the following issues: - Update to 2.8 - Added `target` parameter to urlize function. - Added support for `followsymlinks` to the file system loader. - The truncate filter now counts the length. - Added equalto filter that helps with select filters. - Changed cache keys to use absolute file names if available instead of load names. - Fixed loop length calculation for some iterators. - Changed how Jinja2 enforces strings to be native strings in Python 2 to work when people break their default encoding. - Added :func:`make_logging_undefined` which returns an undefined object that logs failures into a logger. - If unmarshalling of cached data fails the template will be reloaded now. - Implemented a block ``set`` tag. - Default cache size was incrased to 400 from a low 50. - Fixed ``is number`` test to accept long integers in all Python versions. - Changed ``is number`` to accept Decimal as a number. - Added a check for default arguments followed by non-default arguments. This change makes ``{% macro m(x, y=1, z) %}...{% endmacro %}`` a syntax error. The previous behavior for this code was broken anyway (resulting in the default value being applied to `y`). - Add ability to use custom subclasses of ``jinja2.compiler.CodeGenerator`` and ``jinja2.runtime.Context`` by adding two new attributes to the environment (`code_generator_class` and `context_class`) (pull request ``#404``). - added support for context/environment/evalctx decorator functions on the finalize callback of the environment. - escape query strings for urlencode properly. Previously slashes were not escaped in that place. - Add 'base' parameter to 'int' filter. - Tests are removed from the package (not distributed in the tar.gz) - Use %python_version over %py_ver: better portability to RHEL - run testsuite during build - adjust dependency to use up to date package name for python-MarkupSafe - Update to 2.7.3 (boo#858239, CVE-2014-0012) - Security issue: Corrected the security fix for the cache folder. This fix was provided by RedHat. - fix package build (file selection missing) - avoid rebuildcycle with vim - update to 2.7.2: - Prefix loader was not forwarding the locals properly to inner loaders. This is now fixed. - Security issue: Changed the default folder for the filesystem cache to be user specific and read and write protected on UNIX systems. See `Debian bug 734747`_ for more information. - Require python-setuptools instead of distribute (upstreams merged) - Avoid "Recommends:" on old rpm distros - update to 2.7.1: - Fixed a bug with ``call_filter`` not working properly on environment and context filters. - Fixed lack of Python 3 support for bytecode caches. - Reverted support for defining blocks in included templates as this broke existing templates for users. - Fixed some warnings with hashing of undefineds and nodes if Python is run with warnings for Python 3. - Added support for properly hashing undefined objects. - Fixed a bug with the title filter not working on already uppercase strings. - update to 2.7: - Choice and prefix loaders now dispatch source and template lookup separately in order to work in combination with module loaders as advertised. - Fixed filesizeformat. - Added a non-silent option for babel extraction. - Added `urlencode` filter that automatically quotes values for URL safe usage with utf-8 as only supported encoding. If applications want to change this encoding they can override the filter. - Added `keep-trailing-newline` configuration to environments and templates to optionally preserve the final trailing newline. - Accessing `last` on the loop context no longer causes the iterator to be consumed into a list. - Python requirement changed: 2.6, 2.7 or >= 3.3 are required now, supported by same source code, using the "six" compatibility library. - Allow `contextfunction` and other decorators to be applied to `__call__`. - Added support for changing from newline to different signs in the `wordwrap` filter. - Added support for ignoring memcache errors silently. - Added support for keeping the trailing newline in templates. - Added finer grained support for stripping whitespace on the left side of blocks. - Added `map`, `select`, `reject`, `selectattr` and `rejectattr` filters. - Added support for `loop.depth` to figure out how deep inside a recursive loop the code is. - Disabled py_compile for pypy and python 3. - Fix building python 3 package on openSUSE 11.4 x86_64 - Add 2to3 buildrequires to allow for proper conversion of python 3 version - Add python 3 package - Simplify vim plugin packaging - Add suggests for vim and emacs in their respective packages - Removed test for obsolete openSUSE version - Simplified macro usage - Split of 'vim' and 'emacs' sub-packages that contain syntax highlighting support for both editors - Set license to BSD-3-Clause (SPDX style) - Require python-distribute instead of python-setuptools - Update to version 2.6: * internal attributes now raise an internal attribute error now instead of returning an undefined. This fixes problems when passing undefined objects to Python semantics expecting APIs. * traceback support now works properly for PyPy. (Tested with 1.4) * implemented operator intercepting for sandboxed environments. This allows application developers to disable builtin operators for better security. (For instance limit the mathematical operators to actual integers instead of longs) * groupby filter now supports dotted notation for grouping by attributes of attributes. * scoped blocks not properly treat toplevel assignments and imports. Previously an import suddenly "disappeared" in a scoped block. * automatically detect newer Python interpreter versions before loading code from bytecode caches to prevent segfaults on invalid opcodes. The segfault in earlier Jinja2 versions here was not a Jinja2 bug but a limitation in the underlying Python interpreter. If you notice Jinja2 segfaulting in earlier versions after an upgrade of the Python interpreter you don't have to upgrade, it's enough to flush the bytecode cache. This just no longer makes this necessary, Jinja2 will automatically detect these cases now. * the sum filter can now sum up values by attribute. This is a backwards incompatible change. The argument to the filter previously was the optional starting index which defaultes to zero. This now became the second argument to the function because it's rarely used. * like sum, sort now also makes it possible to order items by attribute. * like sum and sort, join now also is able to join attributes of objects as string. * the internal eval context now has a reference to the environment. * added a mapping test to see if an object is a dict or an object with a similar interface. - Renamed to python-Jinja2 - Fix wrong EOL encodings - Do not require python-setuptools, buildrequires is sufficient - Removed authors from description - Changed license to BSD3c - rpmlint issues cleanup * fdupes, tar.bz2 tarball, ... - package docs again (lost with last revision) - re-generated spec file with py2pack * now builds for Fedora and Mandriva - Update to 2.2.1; - Fixed changes file name. - initial package (2.1.1) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-244=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): python-Jinja2-2.8-2.1 python-Jinja2-emacs-2.8-2.1 python-Jinja2-vim-2.8-2.1 References: https://www.suse.com/security/cve/CVE-2014-0012.html https://bugzilla.suse.com/858239 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0243-1: moderate: Security update for dovecot23
by opensuse-security＠opensuse.org 25 Feb '19

25 Feb '19

openSUSE Security Update: Security update for dovecot23 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0243-1 Rating: moderate References: #1119850 #1123022 #1124356 Cross-References: CVE-2019-3814 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for dovecot23 fixes the following issues: dovecot was updated to 2.3.3 release, bringing lots of bugfixes (bsc#1124356). Also the following security issue was fixed: - CVE-2019-3814: A vulnerability in Dovecot related to SSL client certificate authentication was fixed (bsc#1123022) The package changes: Updated pigeonhole to 0.5.3: - Fix assertion panic occurring when managesieve service fails to open INBOX while saving a Sieve script. This was caused by a lack of cleanup after failure. - Fix specific messages causing an assert panic with actions that compose a reply (e.g. vacation). With some rather weird input from the original message, the header folding algorithm (as used for composing the References header for the reply) got confused, causing the panic. - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command parsing. After finishing reading the Sieve script, the command parsing sometimes didn't continue with the search arguments. This is a time- critical bug that likely only occurs when the Sieve script is sent in the next TCP frame. dovecot23 was updated to 2.3.3: - doveconf hides more secrets now in the default output. - ssl_dh setting is no longer enforced at startup. If it's not set and non-ECC DH key exchange happens, error is logged and client is disconnected. - Added log_debug=<filter> setting. - Added log_core_filter=<log filter> setting. - quota-clone: Write to dict asynchronously - --enable-hardening attempts to use retpoline Spectre 2 mitigations - lmtp proxy: Support source_ip passdb extra field. - doveadm stats dump: Support more fields and output stddev by default. - push-notification: Add SSL support for OX backend. - NUL bytes in mail headers can cause truncated replies when fetched. - director: Conflicting host up/down state changes may in some rare situations ended up in a loop of two directors constantly overwriting each others' changes. - director: Fix hang/crash when multiple doveadm commands are being handled concurrently. - director: Fix assert-crash if doveadm disconnects too early - virtual plugin: Some searches used 100% CPU for many seconds - dsync assert-crashed with acl plugin in some situations. (bsc#1119850) - mail_attachment_detection_options=add-flags-on-save assert-crashed with some specific Sieve scripts. - Mail snippet generation crashed with mails containing invalid Content-Type:multipart header. - Log prefix ordering was different for some log lines. - quota: With noenforcing option current quota usage wasn't updated. - auth: Kerberos authentication against Samba assert-crashed. - stats clients were unnecessarily chatty with the stats server. - imapc: Fixed various assert-crashes when reconnecting to server. - lmtp, submission: Fix potential crash if client disconnects while handling a command. - quota: Fixed compiling with glibc-2.26 / support libtirpc. - fts-solr: Empty search values resulted in 400 Bad Request errors - fts-solr: default_ns parameter couldn't be used - submission server crashed if relay server returned over 7 lines in a reply (e.g. to EHLO) dovecot was updated to 2.3.2.1: - SSL/TLS servers may have crashed during client disconnection - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have sometimes assert-crashed. - v2.3.2: "make check" may have crashed with 32bit systems dovecot was updated to 2.3.2: - old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE while opening /proc/self/io. This may still cause security problems if the process is ptrace()d at the same time. Instead, open it while still running as root. - doveadm: Added mailbox cache decision&remove commands. See doveadm-mailbox(1) man page for details. - doveadm: Added rebuild attachments command for rebuilding $HasAttachment or $HasNoAttachment flags for matching mails. See doveadm-rebuild(1) man page for details. - cassandra: Use fallback_consistency on more types of errors - lmtp proxy: Support outgoing SSL/TLS connections - lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings. - submission: Add support for rawlog_dir - submission: Add submission_client_workarounds setting. - lua auth: Add password_verify() function and additional fields in auth request. - doveadm-server: TCP connections are hanging when there is a lot of network output. This especially caused hangs in dsync-replication. - Using multiple type=shared mdbox namespaces crashed - mail_fsync setting was ignored. It was always set to "optimized". - lua auth: Fix potential crash at deinit - SSL/TLS servers may have crashed if client disconnected during handshake. - SSL/TLS servers: Don't send extraneous certificates to client when alt certs are used. - lda, lmtp: Return-Path header without '<' may have assert-crashed. - lda, lmtp: Unencoded UTF-8 in email address headers may assert-crash - lda: -f parameter didn't allow empty/null/domainless address - lmtp, submission: Message size limit was hardcoded to 40 MB. Exceeding it caused the connection to get dropped during transfer. - lmtp: Fix potential crash when delivery fails at DATA stage - lmtp: login_greeting setting was ignored - Fix to work with OpenSSL v1.0.2f - systemd unit restrictions were too strict by default - Fix potential crashes when a lot of log output was produced - SMTP client may have assert-crashed when sending mail - IMAP COMPRESS: Send "end of compression" marker when disconnecting. - cassandra: Fix consistency=quorum to work - dsync: Lock file generation failed if home directory didn't exist - Snippet generation for HTML mails didn't ignore &entities inside blockquotes, producing strange looking snippets. - imapc: Fix assert-crash if getting disconnected and after reconnection all mails in the selected mailbox are gone. - pop3c: Handle unexpected server disconnections without assert-crash - fts: Fixes to indexing mails via virtual mailboxes. - fts: If mails contained NUL characters, the text around it wasn't indexed. - Obsolete dovecot.index.cache offsets were sometimes used. Trying to fetch a field that was just added to cache file may not have always found it. pigeonhole was updated to 0.5.2: - Implement plugin for the a vendor-defined IMAP capability called "FILTER=SIEVE". It adds the ability to manually invoke Sieve filtering in IMAP. More information can be found in doc/plugins/imap_filter_sieve.txt. - The Sieve addess test caused an assertion panic for invalid addresses with UTF-8 codepoints in the localpart. Fixed by properly detecting invalid addresses with UTF-8 codepoints in the localpart and skipping these like other invalid addresses while iterating addresses for the address test. - Make the length of the subject header for the vacation response configurable and enforce the limit in UTF-8 codepoints rather than bytes. The subject header for a vacation response was statically truncated to 256 bytes, which is too limited for multi-byte UTF-8 characters. - Sieve editheader extension: Fix assertion panic occurring when it is used to manipulate a message header with a very large header field. - Properly abort execution of the sieve_discard script upon error. Before, the LDA Sieve plugin attempted to execute the sieve_discard script when an error occurs. This can lead to the message being lost. - Fix the interaction between quota and the sieve_discard script. When quota was used together with a sieve_discard script, the message delivery did not bounce when the quota was exceeded. - Fix crash for over quota users This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-243=1 Package List: - openSUSE Leap 15.0 (x86_64): dovecot23-2.3.3-lp150.3.3.1 dovecot23-backend-mysql-2.3.3-lp150.3.3.1 dovecot23-backend-mysql-debuginfo-2.3.3-lp150.3.3.1 dovecot23-backend-pgsql-2.3.3-lp150.3.3.1 dovecot23-backend-pgsql-debuginfo-2.3.3-lp150.3.3.1 dovecot23-backend-sqlite-2.3.3-lp150.3.3.1 dovecot23-backend-sqlite-debuginfo-2.3.3-lp150.3.3.1 dovecot23-debuginfo-2.3.3-lp150.3.3.1 dovecot23-debugsource-2.3.3-lp150.3.3.1 dovecot23-devel-2.3.3-lp150.3.3.1 dovecot23-fts-2.3.3-lp150.3.3.1 dovecot23-fts-debuginfo-2.3.3-lp150.3.3.1 dovecot23-fts-lucene-2.3.3-lp150.3.3.1 dovecot23-fts-lucene-debuginfo-2.3.3-lp150.3.3.1 dovecot23-fts-solr-2.3.3-lp150.3.3.1 dovecot23-fts-solr-debuginfo-2.3.3-lp150.3.3.1 dovecot23-fts-squat-2.3.3-lp150.3.3.1 dovecot23-fts-squat-debuginfo-2.3.3-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-3814.html https://bugzilla.suse.com/1119850 https://bugzilla.suse.com/1123022 https://bugzilla.suse.com/1124356 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0245-1: important: Security update for python-numpy
by opensuse-security＠opensuse.org 25 Feb '19

25 Feb '19

openSUSE Security Update: Security update for python-numpy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0245-1 Rating: important References: #1122208 Cross-References: CVE-2019-6446 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-numpy fixes the following issue: Security issue fixed: - CVE-2019-6446: Set allow_pickle to false by default to restrict loading untrusted content (bsc#1122208). With this update we decrease the possibility of allowing remote attackers to execute arbitrary code by misusing numpy.load(). A warning during runtime will show-up when the allow_pickle is not explicitly set. NOTE: By applying this update the behavior of python-numpy changes, which might break your application. In order to get the old behaviour back, you have to explicitly set `allow_pickle` to True. Be aware that this should only be done for trusted input, as loading untrusted input might lead to arbitrary code execution. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-245=1 Package List: - openSUSE Leap 15.0 (x86_64): python-numpy-debuginfo-1.14.0-lp150.3.3.1 python-numpy-debugsource-1.14.0-lp150.3.3.1 python-numpy_1_14_0-gnu-hpc-debuginfo-1.14.0-lp150.3.3.1 python-numpy_1_14_0-gnu-hpc-debugsource-1.14.0-lp150.3.3.1 python2-numpy-1.14.0-lp150.3.3.1 python2-numpy-debuginfo-1.14.0-lp150.3.3.1 python2-numpy-devel-1.14.0-lp150.3.3.1 python2-numpy-gnu-hpc-1.14.0-lp150.3.3.1 python2-numpy-gnu-hpc-devel-1.14.0-lp150.3.3.1 python2-numpy_1_14_0-gnu-hpc-1.14.0-lp150.3.3.1 python2-numpy_1_14_0-gnu-hpc-debuginfo-1.14.0-lp150.3.3.1 python2-numpy_1_14_0-gnu-hpc-devel-1.14.0-lp150.3.3.1 python3-numpy-1.14.0-lp150.3.3.1 python3-numpy-debuginfo-1.14.0-lp150.3.3.1 python3-numpy-devel-1.14.0-lp150.3.3.1 python3-numpy-gnu-hpc-1.14.0-lp150.3.3.1 python3-numpy-gnu-hpc-devel-1.14.0-lp150.3.3.1 python3-numpy_1_14_0-gnu-hpc-1.14.0-lp150.3.3.1 python3-numpy_1_14_0-gnu-hpc-debuginfo-1.14.0-lp150.3.3.1 python3-numpy_1_14_0-gnu-hpc-devel-1.14.0-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-6446.html https://bugzilla.suse.com/1122208 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0242-1: moderate: Security update for kauth
by opensuse-security＠opensuse.org 25 Feb '19

25 Feb '19

openSUSE Security Update: Security update for kauth ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0242-1 Rating: moderate References: #1124863 Cross-References: CVE-2019-7443 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kauth fixes the following issues: Security issue fixed: - CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants (bsc#1124863). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-242=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-242=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-242=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): kauth-debugsource-5.32.0-3.3.1 kauth-devel-5.32.0-3.3.1 libKF5Auth5-5.32.0-3.3.1 libKF5Auth5-debuginfo-5.32.0-3.3.1 - openSUSE Leap 42.3 (x86_64): kauth-devel-32bit-5.32.0-3.3.1 libKF5Auth5-32bit-5.32.0-3.3.1 libKF5Auth5-debuginfo-32bit-5.32.0-3.3.1 - openSUSE Leap 42.3 (noarch): libKF5Auth5-lang-5.32.0-3.3.1 - openSUSE Leap 15.0 (i586 x86_64): kauth-debugsource-5.45.0-lp150.3.3.1 kauth-devel-5.45.0-lp150.3.3.1 libKF5Auth5-5.45.0-lp150.3.3.1 libKF5Auth5-debuginfo-5.45.0-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): libKF5Auth5-lang-5.45.0-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): kauth-devel-32bit-5.45.0-lp150.3.3.1 libKF5Auth5-32bit-5.45.0-lp150.3.3.1 libKF5Auth5-32bit-debuginfo-5.45.0-lp150.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): kauth-debugsource-5.45.0-bp150.3.3.1 kauth-devel-5.45.0-bp150.3.3.1 libKF5Auth5-5.45.0-bp150.3.3.1 libKF5Auth5-debuginfo-5.45.0-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): kauth-devel-64bit-5.45.0-bp150.3.3.1 libKF5Auth5-64bit-5.45.0-bp150.3.3.1 libKF5Auth5-64bit-debuginfo-5.45.0-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): libKF5Auth5-lang-5.45.0-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-7443.html https://bugzilla.suse.com/1124863 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0240-1: moderate: Security update for pspp, spread-sheet-widget
by opensuse-security＠opensuse.org 24 Feb '19

24 Feb '19

openSUSE Security Update: Security update for pspp, spread-sheet-widget ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0240-1 Rating: moderate References: #1120061 Cross-References: CVE-2018-20230 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pspp to version 1.2.0 fixes the following issues: Security issue fixed: - CVE-2018-20230: Fixed a heap-based buffer overflow in read_bytes_internal function that could lead to denial-of-service (bsc#1120061). Other bug fixes and changes: - Add upstream patch to avoid compiling with old Texinfo 4.13. - New experimental command SAVE DATA COLLECTION to save MDD files. - MTIME and YMDHMS variable formats now supported. - Spread sheet rendering now done via spread-sheet-widget. This update introduces a new package called spread-sheet-widget as dependency. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-240=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libspread-sheet-widget0-0.3-bp150.2.1 libspread-sheet-widget0-debuginfo-0.3-bp150.2.1 pspp-1.2.0-bp150.3.3.1 pspp-devel-1.2.0-bp150.3.3.1 spread-sheet-widget-debugsource-0.3-bp150.2.1 spread-sheet-widget-devel-0.3-bp150.2.1 References: https://www.suse.com/security/cve/CVE-2018-20230.html https://bugzilla.suse.com/1120061 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0239-1: important: Security update for python-python-gnupg
by opensuse-security＠opensuse.org 23 Feb '19

23 Feb '19

openSUSE Security Update: Security update for python-python-gnupg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0239-1 Rating: important References: #1123498 Cross-References: CVE-2019-6690 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-python-gnupg to version 0.4.4 fixes the following issues: Security issue fixed: - CVE-2019-6690: Added a check to disallow certain control characters ('\r', '\n', NUL) in passphrases (boo#1123498). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-239=1 Package List: - openSUSE Backports SLE-15 (noarch): python2-python-gnupg-0.4.4-bp150.2.3.1 python3-python-gnupg-0.4.4-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-6690.html https://bugzilla.suse.com/1123498 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0238-1: moderate: Security update for ansible
by opensuse-security＠opensuse.org 23 Feb '19

23 Feb '19

openSUSE Security Update: Security update for ansible ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0238-1 Rating: moderate References: #1056094 #1097775 Cross-References: CVE-2017-7466 CVE-2017-7481 CVE-2018-10855 CVE-2018-10875 CVE-2018-16859 CVE-2018-16876 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for ansible fixes the following issues: Security vulnerabilities fixed: - CVE-2018-16876: Respect no_log on retry and high verbosity (bsc#1118896) - CVE-2018-16859: Windows - prevent sensitive content from appearing in scriptblock logging (bsc#1116587) - CVE-2018-10855: Fixed the honouration of the no_log option with failed task iterations (boo#1097775) - CVE-2017-7466: Fixed an input validation vulnerability in Ansible's handling of data sent from client systems - CVE-2017-7481: Fixed a security issue with lookup return not tainting the jinja2 environment (bsc#1038785) Other bug fixes and changes: - Update to version 2.7.6 * Added log message at -vvvv when using netconf connection listing connection details. * Changes how ansible-connection names socket lock files. They now use the same name as the socket itself, and as such do not lock other attempts on connections to the same host, or cause issues with overly-long hostnames. * Fix mandatory statement error for junos modules (https://github.com/ansible/ansible/pull/50138) * Moved error in netconf connection plugin from at import to on connection. * This reverts some changes from commit 723daf3. If a line is found in the file, exactly or via regexp matching, it must not be added again. insertafter/insertbefore options are used only when a line is to be inserted, to specify where it must be added. * allow using openstack inventory plugin w/o a cache * callbacks - Do not filter out exception, warnings, deprecations on failure when using debug (https://github.com/ansible/ansible/issues/47576) * certificate_complete_chain - fix behavior when invalid file is parsed while reading intermediate or root certificates. * copy - Ensure that the src file contents is converted to unicode in diff information so that it is properly wrapped by AnsibleUnsafeText to prevent unexpected templating of diff data in Python3 (https://github.com/ansible/ansible/issues/45717) * correct behaviour of verify_file for vmware inventory plugin, it was always returning True * dnf - fix issue where conf_file was not being loaded properly * dnf - fix update_cache combined with install operation to not cause dnf transaction failure * docker_container - fix network_mode idempotency if the container:<container-name> form is used (as opposed to container:<container-id>) (https://github.com/ansible/ansible/issues/49794) * docker_container - warning when non-string env values are found, avoiding YAML parsing issues. Will be made an error in Ansible 2.8. (https://github.com/ansible/ansible/issues/49802) * docker_swarm_service - Document labels and container_labels with correct type. * docker_swarm_service - Document limit_memory and reserve_memory correctly on how to specify sizes. * docker_swarm_service - Document minimal API version for configs and secrets. * docker_swarm_service - fix use of Docker API so that services are not detected as present if there is an existing service whose name is a substring of the desired service * docker_swarm_service - fixing falsely reporting update_order as changed when option is not used. * document old option that was initally missed * ec2_instance now respects check mode https://github.com/ansible/ansible/pull/46774 * fix for network_cli - ansible_command_timeout not working as expected (#49466) * fix handling of firewalld port if protocol is missing * fix lastpass lookup failure on python 3 (https://github.com/ansible/ansible/issues/42062) * flatpak - Fixed Python 2/3 compatibility * flatpak - Fixed issue where newer versions of flatpak failed on flatpak removal * flatpak_remote - Fixed Python 2/3 compatibility * gcp_compute_instance - fix crash when the instance metadata is not set * grafana_dashboard - Fix a pair of unicode string handling issues with version checking (https://github.com/ansible/ansible/pull/49194) * host execution order - Fix reverse_inventory not to change the order of the items before reversing on python2 and to not backtrace on python3 * icinga2_host - fixed the issue with not working use_proxy option of the module. * influxdb_user - An unspecified password now sets the password to blank, except on existing users. This previously caused an unhandled exception. * influxdb_user - Fixed unhandled exception when using invalid login credentials (https://github.com/ansible/ansible/issues/50131) * openssl_* - fix error when path contains a file name without path. * openssl_csr - fix problem with idempotency of keyUsage option. * openssl_pkcs12 - now does proper path expansion for ca_certificates. * os_security_group_rule - os_security_group_rule doesn't exit properly when secgroup doesn't exist and state=absent (https://github.com/ansible/ansible/issues/50057) * paramiko_ssh - add auth_timeout parameter to ssh.connect when supported by installed paramiko version. This will prevent "Authentication timeout" errors when a slow authentication step (>30s) happens with a host (https://github.com/ansible/ansible/issues/42596) * purefa_facts and purefb_facts now correctly adds facts into main ansible_fact dictionary (https://github.com/ansible/ansible/pull/50349) * reboot - add appropriate commands to make the plugin work with VMware ESXi (https://github.com/ansible/ansible/issues/48425) * reboot - add support for rebooting AIX (https://github.com/ansible/ansible/issues/49712) * reboot - gather distribution information in order to support Alpine and other distributions (https://github.com/ansible/ansible/issues/46723) * reboot - search common paths for the shutdown command and use the full path to the binary rather than depending on the PATH of the remote system (https://github.com/ansible/ansible/issues/47131) * reboot - use a common set of commands for older and newer Solaris and SunOS variants (https://github.com/ansible/ansible/pull/48986) * redfish_utils - fix reference to local variable 'systems_service' * setup - fix the rounding of the ansible_memtotal_mb value on VMWare vm's (https://github.com/ansible/ansible/issues/49608) * vultr_server - fixed multiple ssh keys were not handled. * win_copy - Fix copy of a dir that contains an empty directory - https://github.com/ansible/ansible/issues/50077 * win_firewall_rule - Remove invalid 'bypass' action * win_lineinfile - Fix issue where a malformed json block was returned causing an error * win_updates - Correctly report changes on success - update to version 2.7.5 * ACME modules: improve error messages in some cases (include error returned by server). * Added unit test for VMware module_utils. * Also check stdout for interpreter errors for more intelligent messages to user * Backported support for Devuan-based distribution * Convert hostvars data in OpenShift inventory plugin to be serializable by ansible-inventory * Fix AttributeError (Python 3 only) when an exception occurs while rendering a template * Fix N3K power supply facts (https://github.com/ansible/ansible/pull/49150). * Fix NameError nxos_facts (https://github.com/ansible/ansible/pull/48981). * Fix VMware module utils for self usage. * Fix error in OpenShift inventory plugin when a pod has errored and is empty * Fix if the route table changed to none (https://github.com/ansible/ansible/pull/49533) * Fix iosxr netconf plugin response namespace (https://github.com/ansible/ansible/pull/49300) * Fix issues with nxos_install_os module for nxapi (https://github.com/ansible/ansible/pull/48811). * Fix lldp and cdp neighbors information (https://github.com/ansible/ansible/pull/48318)(https://github.com/ansible/ ansible/pull/48087)(https://github.com/ansible/ansible/pull/49024). * Fix nxos_interface and nxos_linkagg Idempotence issue (https://github.com/ansible/ansible/pull/46437). * Fix traceback when updating facts and the fact cache plugin was nonfunctional * Fix using vault encrypted data with jinja2_native (https://github.com/ansible/ansible/issues/48950) * Fixed: Make sure that the files excluded when extracting the archive are not checked. https://github.com/ansible/ansible/pull/45122 * Fixes issue where a password parameter was not set to no_log * aci_rest - Fix issue ignoring custom port * acme_account, acme_account_facts - in some cases, it could happen that the modules return information on disabled accounts accidentally returned by the ACME server. * docker_swarm - decreased minimal required API version from 1.35 to 1.25; some features require API version 1.30 though. * docker_swarm_service: fails because of default "user: root" (https://github.com/ansible/ansible/issues/49199) * ec2_metadata_facts - Parse IAM role name from the security credential field since the instance profile name is different * fix azure_rm_image module use positional parameter (https://github.com/ansible/ansible/pull/49394) * fixes an issue with dict_merge in network utils (https://github.com/ansible/ansible/pull/49474) * gcp_utils - fix google auth scoping issue with application default credentials or google cloud engine credentials. Only scope credentials that can be scoped. * mail - fix python 2.7 regression * openstack - fix parameter handling when cloud provided as dict https://github.com/ansible/ansible/issues/42858 * os_user - Include domain parameter in user deletion https://github.com/ansible/ansible/issues/42901 * os_user - Include domain parameter in user lookup https://github.com/ansible/ansible/issues/42901 * ovirt_storage_connection - comparing passwords breaks idempotency in update_check (https://github.com/ansible/ansible/issues/48933) * paramiko_ssh - improve log message to state the connection type * reboot - use IndexError instead of TypeError in exception * redis cache - Support version 3 of the redis python library (https://github.com/ansible/ansible/issues/49341) * sensu_silence - Cast int for expire field to avoid call failure to sensu API. * vmware_host_service_facts - handle exception when service package does not have package name. * win_nssm - Switched to Argv-ToString for escaping NSSM credentials (https://github.com/ansible/ansible/issues/48728) * zabbix_hostmacro - Added missing validate_certs logic for running module against Zabbix servers with untrused SSL certificates (https://github.com/ansible/ansible/issues/47611) * zabbix_hostmacro - Fixed support for user macros with context (https://github.com/ansible/ansible/issues/46953) - update to version 2.7.4 * powershell - add lib/ansible/executor/powershell to the packaging data - update to version 2.7.3 * Fix the issue that FTD HTTP API retries authentication-related HTTP requests * Fix the issue that module fails when the Swagger model does not have required fields * Fix the issue with comparing string-like objects * Fix using omit on play keywords * apt_key - Disable TTY requirement in GnuPG for the module to work correctly when SSH pipelining is enabled * better error message when bad type in config, deal with EVNAR= more gracefully * configuration retrieval would fail on non primed plugins * cs_template - Fixed a KeyError on state=extracted * docker_container - fix idempotency problems with docker-py caused by previous init idempotency fix * docker_container - fix interplay of docker-py version check with argument_spec validation improvements * docker_network - driver_options containing Python booleans would cause Docker to throw exceptions * ec2_group - Fix comparison of determining which rules to purge by ignoring descriptions * pip module - fix setuptools/distutils replacement * sysvinit - enabling a service should use "defaults" if no runlevels are specified - update to version 2.7.2 * Minor changes - update to 2.7.1 * Minor changes - update to 2.7.0 * Allow config to enable native jinja types * Remove support for simplejson * yum and dnf modules now at feature parity * Security Fix - avoid loading host/group vars from cwd when not specifying a playbook or playbook base dir * Security Fix - avoid using ansible.cfg in a world writable dir * Some connection exception would cause no_log specified on a task to be ignored (stdout info disclosure) * Fix glob path of rc.d (SUSE-specific) * Fix lambda_policy updates * Fix alt linux detection/matching - update to 2.6.4 * Add md5sum check in nxos_file_copy module * Allow arbitrary log_driver for docker_container * Fix Python2.6 regex bug terminal plugin nxos, iosxr * Fix check_mode in nxos_static_route module * Fix glob path of rc.d Some distribtuions like SUSE has the rc%.d directories under /etc/init.d * Fix network config diff issue for lines * Fixed an issue where ansible_facts.pkg_mgr would incorrectly set to zypper on Debian/Ubuntu systems that happened to have the command installed * The docker_* modules respect the DOCKER_* environment variables again * The fix for CVE-2018-10875 prints out a warning message about skipping a config file from a world writable current working directory. However, if the user is in a world writable current working directory which does not contain a config file, it should not print a warning message. This release fixes that extaneous warning. * To resolve nios_network issue where vendor-encapsulated-options can not have a use_option flag. * To resolve the issue of handling exception for Nios lookup gracefully. * always correctly template no log for tasks * ansible-galaxy - properly list all roles in roles_path * basic.py - catch ValueError in case a FIPS enabled platform raises this exception * docker_container: fixing working_dir idempotency problem * docker_container: makes unit parsing for memory sizes more consistent, and fixes idempotency problem when kernel_memory is set * fix example code for AWS lightsail documentation * fix the enable_snat parameter that is only supposed to be used by an user with the right policies. * fixes docker_container check and debug mode * improves docker_container idempotency * ios_l2_interface - fix bug when list of vlans ends with comma * ios_l2_interface - fix issue with certain interface types * ios_user - fix unable to delete user admin issue * ios_vlan - fix unable to work on certain interface types issue * nxos_facts test lldp feature and fix nxapi check_rc * nxos_interface port-channel idempotence fix for mode * nxos_linkagg mode fix * nxos_system idempotence fix * nxos_vlan refactor to support non structured output * one_host - fixes settings via environment variables * use retry_json nxos_banner * user - Strip trailing comments in /etc/default/passwd * user - when creating a new user without an expiration date, properly set no expiration rather that expirining the account * win_domain_computer - fixed deletion of computer active directory object that have dependent objects * win_domain_computer - fixed error in diff_support * win_domain_computer - fixed error when description parameter is empty * win_psexec - changed code to not escape the command option when building the args * win_uri -- Fix support for JSON output when charset is set * win_wait_for - fix issue where timeout doesn't wait unless state=drained - update to 2.6.3 * Fix lxd module to be idempotent when the given configuration for the lxd container has not changed * Fix setting value type to str to avoid conversion during template read. Fix Idempotency in case of 'no key'. * Fix the mount module's handling of swap entries in fstab * The fix for (CVE-2018-10875) prints out a warning message about skipping a config file from a world writable current working directory. However, if the user explicitly specifies that the config file should be used via the ANSIBLE_CONFIG environment variable then Ansible would honor that but still print out the warning message. This has been fixed so that Ansible honors the user's explicit wishes and does not print a warning message in that circumstance. * To fix the bug where existing host_record was deleted when existing record name is used with different IP. * VMware handle pnic in proxyswitch * fix azure security group cannot add rules when purge_rule set to false. * fix azure_rm_deployment collect tags from existing Resource Group. * fix azure_rm_loadbalancer_facts list takes at least 2 arguments. * fix for the bundled selectors module (used in the ssh and local connection plugins) when a syscall is restarted after being interrupted by a signal * get_url - fix the bug that get_url does not change mode when checksum matches * nicer error when multiprocessing breaks * openssl_certificate - Convert valid_date to bytes for conversion * openstack_inventory.py dynamic inventory file fixed the plugin to the script so that it will work with current ansible-inventory. Also redirect stdout before dumping the ouptput, because not doing so will cause JSON parse errors in some cases. * slack callback - Fix invocation by looking up data from cli.options * sysvinit module: handle values of optional parameters. Don't disable service when enabled parameter isn't set. Fix command when arguments parameter isn't set. * vars_prompt - properly template play level variables in vars_prompt * win_domain - ensure the Netlogon service is up and running after promoting host to controller * win_domain_controller - ensure the Netlogon service is up and running after promoting host to controller - update to 2.6.2 + Add text output along with structured output in nxos_facts + Allow more than one page of results by using the right pagination indicator ('NextMarker' instead of 'NextToken'). + Fix an atomic_move error that is 'true', but misleading. Now we show all 3 files involved and clarify what happened. + Fix eos_l2_interface eapi. + Fix fetching old style facts in junos_facts module + Fix get_device_info nxos zero or more whitespace regex + Fix nxos CI failures + Fix nxos_nxapi default http behavior + Fix nxos_vxlan_vtep_vni + Fix regex network_os_platform nxos + Refactor nxos cliconf get_device_info for non structured output supported devices + To fix the NoneType error raised in ios_l2_interface when Access Mode VLAN is unassigned + emtpy host/group name is an error + fix default SSL version for docker modules + fix mail module when using starttls + fix nmap config example + fix ps detection of service + fix the remote tmp folder permissions issue when becoming a non admin user + fix typoe in sysvinit that breaks update.rc-d detection + fixes docker_container compatibilty with docker-py < 2.2 + get_capabilities in nxapi module_utils should not return empty dictionary + inventory - When using an inventory directory, ensure extension comparison uses text types + ios_vlan - fix unable to identify correct vlans issue + nxos_facts warning message improved + openvswitch_db - make 'key' argument optional + pause - do not set stdout to raw mode when redirecting to a file + pause - nest try except when importing curses to gracefully fail if curses is not present + plugins/inventory/openstack.py - Do not create group with empty name if region is not set + preseve delegation info on nolog + remove ambiguity when it comes to 'the source' + remove dupes from var precedence + restores filtering out conflicting facts + user - fix bug that resulted in module always reporting a change when specifiying the home directory on FreeBSD + user - use correct attribute name in FreeBSD for creat_home + vultr - Do not fail trying to load configuration from ini files if required variables have been set as environment variables. + vyos_command correcting conditionals looping + win_chocolatey - enable TLSv1.2 support when downloading the Chocolatey installer + win_reboot - fix for handling an already scheduled reboot and other minor log formatting issues + win_reboot - fix issue when overridding connection timeout hung the post reboot uptime check + win_reboot - handle post reboots when running test_command + win_security_policy - allows an empty string to reset a policy value + win_share - discard any cmdlet output we don't use to ensure only the return json is received by Ansible + win_unzip - discard any cmdlet output we don't use to ensure only the return json is received by Ansible + win_updates - fixed module return value is lost in error in some cases + win_user - Use LogonUser to validate the password as it does not rely on SMB/RPC to be available + Security Fix - avoid loading host/group vars from cwd when not specifying a playbook or playbook base dir + Security Fix - avoid using ansible.cfg in a world writable dir. + Fix junos_config confirm commit timeout issue (https://github.com/ansible/ansible/pull/41527) + file module - The touch subcommand had its diff output broken during the 2.6.x development cycle. This is now fixed. + inventory manager - This fixes required options being populated before the inventory config file is read, so the required options may be set in the config file. + nsupdate - allow hmac-sha384 https://github.com/ansible/ansible/pull/42209 + win_domain - fixes typo in one of the AD cmdlets https://github.com/ansible/ansible/issues/41536 + win_group_membership - uses the internal Ansible SID conversion logic and uses that when comparing group membership instead of the name - use fdupes to save some space in python_sitelib - define BuildRoot on older distributions like SLE-11 - be a bit more flexible with the ending of manpage files to allow Fedora builds to succeed - updated to latest release 2.6.0 - New Plugins: + Callback: - cgroup_memory_recap - grafana_annotations - sumologic + Connection: - httpapi + Inventory: - foreman - gcp_compute - generator - nmap + Lookup: - onepassword - onepassword_raw - Modules updates too many to mention here please look at package documentation directory (/usr/share/doc/packages/.../changelogs) - bug fixes: - **Security Fix** - Some connection exceptions would cause no_log specified on a task to be ignored. If this happened, the task information, including any private information coul d have been displayed to stdout and (if enabled, not the default) logged to a log file specified in ansible.cfg's log_path. Additionally, sites which redirected stdout from ansible runs to a log file may have stored that private information onto disk that way as well. (https://github.com/ansible/ansible/pull/41414) - Changed the admin_users config option to not include "admin" by default as admin is frequently used for a non-privileged account (https://github.com/ansible/ansible/pull/41164) - Changed the output to "text" for "show vrf" command as default "json" output format with respect to "eapi" transport was failing (https://github.com/ansible/ansible/pull/41470) - Document mode=preserve for both the copy and template module - Fix added for Digital Ocean Volumes API change causing Ansible to recieve an unexpected value in the response. (https://github.com/ansible/ansible/pull/41431) - Fix an encoding issue when parsing the examples from a plugins' documentation - Fix iosxr_config module to handle route-policy, community-set, prefix-set, as-path-set and rd-set blocks. All these blocks are part of route-policy language of iosxr. - Fix mode=preserve with remote_src=True for the copy module - Implement mode=preserve for the template module - The yaml callback plugin now allows non-ascii characters to be displayed. - Various grafana_* modules - Port away from the deprecated b64encodestring function to the b64encode function instead. https://github.com/ansible/ansible/pull/38388 - added missing 'raise' to exception definition https://github.com/ansible/ansible/pull/41690 - allow custom endpoints to be used in the aws_s3 module (https://github.com/ansible/ansible/pull/36832) - allow set_options to be called multiple times https://github.com/ansible/ansible/pull/41913 - ansible-doc - fixed traceback on missing plugins (https://github.com/ansible/ansible/pull/41167) - cast the device_mapping volume size to an int in the ec2_ami module (https://github.com/ansible/ansible/pull/40938) - copy - fixed copy to only follow symlinks for files in the non-recursive case - copy module - The copy module was attempting to change the mode of files for remote_src=True even if mode was not set as a parameter. This failed on filesystems which do not have permission bits (https://github.com/ansible/ansible/pull/40099) - copy module - fixed recursive copy with relative paths (https://github.com/ansible/ansible/pull/40166) - correct debug display for all cases https://github.com/ansible/ansible/pull/41331 - correctly check hostvars for vars term https://github.com/ansible/ansible/pull/41819 - correctly handle yaml inventory files when entries are null dicts https://github.com/ansible/ansible/issues/41692 - dynamic includes - Allow inheriting attributes from static parents (https://github.com/ansible/ansible/pull/38827) - dynamic includes - Don't treat undefined vars for conditional includes as truthy (https://github.com/ansible/ansible/pull/39377) - dynamic includes - Fix IncludedFile comparison for free strategy (https://github.com/ansible/ansible/pull/37083) - dynamic includes - Improved performance by fixing re-parenting on copy (https://github.com/ansible/ansible/pull/38747) - dynamic includes - Use the copied and merged task for calculating task vars (https://github.com/ansible/ansible/pull/39762) - file - fixed the default follow behaviour of file to be true - file module - Eliminate an error if we're asked to remove a file but something removes it while we are processing the request (https://github.com/ansible/ansible/pull/39466) - file module - Fix error when recursively assigning permissions and a symlink to a nonexistent file is present in the directory tree (https://github.com/ansible/ansible/issues/39456) - file module - Fix error when running a task which assures a symlink to a nonexistent file exists for the second and subsequent times (https://github.com/ansible/ansible/issues/39558) - file module - The file module allowed the user to specify src as a parameter when state was not link or hard. This is documented as only applying to state=link or state=hard but in previous Ansible, this could have an effect in rare cornercases. For instance, "ansible -m file -a 'state=directory path=/tmp src=/var/lib'" would create /tmp/lib. This has been disabled and a warning emitted (will change to an error in Ansible-2.10). - file module - The touch subcommand had its diff output broken during the 2.6.x development cycle. This is now fixed (https://github.com/ansible/ansible/issues/41755) - fix BotoCoreError exception handling - fix apt-mark on debian6 (https://github.com/ansible/ansible/pull/41530) - fix async for the aws_s3 module by adding async support to the action plugin (https://github.com/ansible/ansible/pull/40826) - fix decrypting vault files for the aws_s3 module (https://github.com/ansible/ansible/pull/39634) - fix errors with S3-compatible APIs if they cannot use ACLs for buckets or objects - fix permission handling to try to download a file even if the user does not have permission to list all objects in the bucket - fixed config required handling, specifically for _terms in lookups https://github.com/ansible/ansible/pull/41740 - gce_net - Fix sorting of allowed ports (https://github.com/ansible/ansible/pull/41567) - group_by - support implicit localhost (https://github.com/ansible/ansible/pull/41860) - import/include - Ensure role handlers have the proper parent, allowing for correct attribute inheritance (https://github.com/ansible/ansible/pull/39426) - import_playbook - Pass vars applied to import_playbook into parsing of the playbook as they may be needed to parse the imported plays (https://github.com/ansible/ansible/pull/39521) - include_role/import_role - Don't overwrite included role handlers with play handlers on parse (https://github.com/ansible/ansible/pull/39563) - include_role/import_role - Fix parameter templating (https://github.com/ansible/ansible/pull/36372) - include_role/import_role - Use the computed role name for include_role/import_role so to diffentiate between names computed from host vars (https://github.com/ansible/ansible/pull/39516)- include_role/import_role - improved performance and recursion depth (https://github.com/ansible/ansible/pull/36470) - lineinfile - fix insertbefore when used with BOF to not insert duplicate lines (https://github.com/ansible/ansible/issues/38219) - password lookup - Do not load password lookup in network filters, allowing the password lookup to be overriden (https://github.com/ansible/ansible/pull/41907) - pause - ensure ctrl+c interrupt works in all cases (https://github.com/ansible/ansible/issues/35372) - powershell - use the tmpdir set by `remote_tmp` for become/async tasks instead of the generic $env:TEMP - https://github.com/ansible/ansible/pull/40210 - selinux - correct check mode behavior to report same changes as normal mode (https://github.com/ansible/ansible/pull/40721) - spwd - With python 3.6 spwd.getspnam returns PermissionError instead of KeyError if user does not have privileges (https://github.com/ansible/ansible/issues/39472) - synchronize - Ensure the local connection created by synchronize uses _remote_is_local=True, which causes ActionBase to build a local tmpdir (https://github.com/ansible/ansible/pull/40833) - template - Fix for encoding issues when a template path contains non-ascii characters and using the template path in ansible_managed (https://github.com/ansible/ansible/issues/27262) - template action plugin - fix the encoding of filenames to avoid tracebacks on Python2 when characters that are not present in the user's locale are present. (https://github.com/ansible/ansible/pull/39424) - user - only change the expiration time when necessary (https://github.com/ansible/ansible/issues/13235) - uses correct conn info for reset_connection https://github.com/ansible/ansible/issues/27520 - win_environment - Fix for issue where the environment value was deleted when a null value or empty string was set - https://github.com/ansible/ansible/issues/40450 - win_file - fix issue where special chars like [ and ] were not being handled correctly https://github.com/ansible/ansible/pull/37901 - win_get_url - fixed a few bugs around authentication and force no when using an FTP URL - win_iis_webapppool - redirect some module output to null so Ansible can read the output JSON https://github.com/ansible/ansible/issues/40874 - win_template - fix when specifying the dest option as a directory with and without the trailing slash https://github.com/ansible/ansible/issues/39886 - win_updates - Added the ability to run on a scheduled task for older hosts so async starts working again - https://github.com/ansible/ansible/issues/38364 - win_updates - Fix logic when using a whitelist for multiple updates - win_updates - Fix typo that hid the download error when a download failed - win_updates - Fixed issue where running win_updates on async fails without any error - windows become - Show better error messages when the become process fails - winrm - Add better error handling when the kinit process fails - winrm - allow `ansible_user` or `ansible_winrm_user` to override `ansible_ssh_user` when both are defined in an inventory - https://github.com/ansible/ansible/issues/39844 - winrm - ensure pexpect is set to not echo the input on a failure and have a manual sanity check afterwards https://github.com/ansible/ansible/issues/41865 - winrm connection plugin - Fix exception messages sometimes raising a traceback when the winrm connection plugin encounters an unrecoverable error. https://github.com/ansible/ansible/pull/39333 - xenserver_facts - ensure module works with newer versions of XenServer (https://github.com/ansible/ansible/pull/35821) - use python3 on (open)SUSE 15 or newer - Update to 2.5.5 - Changed the admin_users config option to not include "admin" by default as admin is frequently used for a non-privileged account - aws_s3 - add async support to the action plugin - aws_s3 - fix decrypting vault files - ec2_ami - cast the device_mapping volume size to an int - eos_logging - fix idempotency issues - cache plugins - A cache timeout of 0 means the cache will not expire. - ios_logging - fix idempotency issues - ios/nxos/eos_config - don't retrieve config in running_config when config is provided for diff - nxos_banner - fix multiline banner issue - nxos terminal plugin - fix output truncation - nxos_l3_interface - fix no switchport issue with loopback and svi interfaces - nxos_snapshot - fix compare_option - update to 2.2.3.0 (boo#1056094) * Various minor bug fixes Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-238=1 Package List: - openSUSE Backports SLE-15 (noarch): ansible-2.7.6-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2017-7466.html https://www.suse.com/security/cve/CVE-2017-7481.html https://www.suse.com/security/cve/CVE-2018-10855.html https://www.suse.com/security/cve/CVE-2018-10875.html https://www.suse.com/security/cve/CVE-2018-16859.html https://www.suse.com/security/cve/CVE-2018-16876.html https://bugzilla.suse.com/1056094 https://bugzilla.suse.com/1097775 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0237-1: Security update for mosquitto
by opensuse-security＠opensuse.org 23 Feb '19

23 Feb '19

openSUSE Security Update: Security update for mosquitto ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0237-1 Rating: low References: #1125019 #1125020 #1125021 Cross-References: CVE-2018-12546 CVE-2018-12550 CVE-2018-12551 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for mosquitto fixes the following issues: Security issues fixed: - CVE-2018-12546: Fixed an issue with revoked access to topics (bsc#1125019). - CVE-2018-12551: Fixed an issue which allowed malformed data in the password file to be treated as valid (bsc#1125020). - CVE-2018-12550: Fixed an an issue which treats an empty ACL file wrongly (bsc#1125021). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-237=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libmosquitto1-1.4.15-bp150.3.3.1 libmosquittopp1-1.4.15-bp150.3.3.1 mosquitto-1.4.15-bp150.3.3.1 mosquitto-clients-1.4.15-bp150.3.3.1 mosquitto-devel-1.4.15-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-12546.html https://www.suse.com/security/cve/CVE-2018-12550.html https://www.suse.com/security/cve/CVE-2018-12551.html https://bugzilla.suse.com/1125019 https://bugzilla.suse.com/1125020 https://bugzilla.suse.com/1125021 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0235-1: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 22 Feb '19

22 Feb '19

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0235-1 Rating: low References: #1124366 Cross-References: CVE-2019-7397 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issues: Security issue fixed: - CVE-2019-7397: Fixed a Memory leak in function WritePDFImage in pdf.c (bsc#1124366) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-235=1 Package List: - openSUSE Backports SLE-15 (x86_64): GraphicsMagick-1.3.29-bp150.2.15.1 GraphicsMagick-devel-1.3.29-bp150.2.15.1 libGraphicsMagick++-Q16-12-1.3.29-bp150.2.15.1 libGraphicsMagick++-devel-1.3.29-bp150.2.15.1 libGraphicsMagick-Q16-3-1.3.29-bp150.2.15.1 libGraphicsMagick3-config-1.3.29-bp150.2.15.1 libGraphicsMagickWand-Q16-2-1.3.29-bp150.2.15.1 perl-GraphicsMagick-1.3.29-bp150.2.15.1 References: https://www.suse.com/security/cve/CVE-2019-7397.html https://bugzilla.suse.com/1124366 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0233-1: Security update for mosquitto
by opensuse-security＠opensuse.org 22 Feb '19

22 Feb '19

openSUSE Security Update: Security update for mosquitto ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0233-1 Rating: low References: #1125019 #1125020 #1125021 Cross-References: CVE-2018-12546 CVE-2018-12550 CVE-2018-12551 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for mosquitto fixes the following issues: Security issues fixed: - CVE-2018-12546: Fixed an issue with revoked access to topics (bsc#1125019). - CVE-2018-12551: Fixed an issue which allowed malformed data in the password file to be treated as valid (bsc#1125020). - CVE-2018-12550: Fixed an an issue which treats an empty ACL file wrongly (bsc#1125021). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-233=1 Package List: - openSUSE Leap 15.0 (x86_64): libmosquitto1-1.4.15-lp150.2.3.1 libmosquitto1-debuginfo-1.4.15-lp150.2.3.1 libmosquittopp1-1.4.15-lp150.2.3.1 libmosquittopp1-debuginfo-1.4.15-lp150.2.3.1 mosquitto-1.4.15-lp150.2.3.1 mosquitto-clients-1.4.15-lp150.2.3.1 mosquitto-clients-debuginfo-1.4.15-lp150.2.3.1 mosquitto-debuginfo-1.4.15-lp150.2.3.1 mosquitto-debugsource-1.4.15-lp150.2.3.1 mosquitto-devel-1.4.15-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-12546.html https://www.suse.com/security/cve/CVE-2018-12550.html https://www.suse.com/security/cve/CVE-2018-12551.html https://bugzilla.suse.com/1125019 https://bugzilla.suse.com/1125020 https://bugzilla.suse.com/1125021 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0232-1: moderate: Security update for build
by opensuse-security＠opensuse.org 22 Feb '19

22 Feb '19

openSUSE Security Update: Security update for build ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0232-1 Rating: moderate References: #1069904 #1122895 Cross-References: CVE-2017-14804 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for build version 20190128 fixes the following issues: Security issue fixed: - CVE-2017-14804: Improve file name check extractbuild (bsc#1069904) Non-security issue fixed: - Add initial SLE 15 SP1 config (bsc#1122895) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-232=1 Package List: - openSUSE Leap 15.0 (noarch): build-20190128-lp150.2.3.1 build-initvm-i586-20190128-lp150.2.3.1 build-initvm-x86_64-20190128-lp150.2.3.1 build-mkbaselibs-20190128-lp150.2.3.1 build-mkdrpms-20190128-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2017-14804.html https://bugzilla.suse.com/1069904 https://bugzilla.suse.com/1122895 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0234-1: important: Security update for nodejs6
by opensuse-security＠opensuse.org 22 Feb '19

22 Feb '19

openSUSE Security Update: Security update for nodejs6 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0234-1 Rating: important References: #1113534 #1113652 #1117625 #1117626 #1117627 #1117629 #1117630 Cross-References: CVE-2018-0734 CVE-2018-12116 CVE-2018-12120 CVE-2018-12121 CVE-2018-12122 CVE-2018-12123 CVE-2018-5407 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for nodejs6 to version 6.16.0 fixes the following issues: Security issues fixed: - CVE-2018-0734: Fixed a timing vulnerability in the DSA signature generation (bsc#1113652) - CVE-2018-5407: Fixed a hyperthread port content side channel attack (aka "PortSmash") (bsc#1113534) - CVE-2018-12120: Fixed that the debugger listens on any interface by default (bsc#1117625) - CVE-2018-12121: Fixed a denial of Service with large HTTP headers (bsc#1117626) - CVE-2018-12122: Fixed the "Slowloris" HTTP Denial of Service (bsc#1117627) - CVE-2018-12116: Fixed HTTP request splitting (bsc#1117630) - CVE-2018-12123: Fixed hostname spoofing in URL parser for javascript protocol (bsc#1117629) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-234=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): nodejs6-6.16.0-18.1 nodejs6-debuginfo-6.16.0-18.1 nodejs6-debugsource-6.16.0-18.1 nodejs6-devel-6.16.0-18.1 npm6-6.16.0-18.1 - openSUSE Leap 42.3 (noarch): nodejs6-docs-6.16.0-18.1 References: https://www.suse.com/security/cve/CVE-2018-0734.html https://www.suse.com/security/cve/CVE-2018-12116.html https://www.suse.com/security/cve/CVE-2018-12120.html https://www.suse.com/security/cve/CVE-2018-12121.html https://www.suse.com/security/cve/CVE-2018-12122.html https://www.suse.com/security/cve/CVE-2018-12123.html https://www.suse.com/security/cve/CVE-2018-5407.html https://bugzilla.suse.com/1113534 https://bugzilla.suse.com/1113652 https://bugzilla.suse.com/1117625 https://bugzilla.suse.com/1117626 https://bugzilla.suse.com/1117627 https://bugzilla.suse.com/1117629 https://bugzilla.suse.com/1117630 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0215-1: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 19 Feb '19

19 Feb '19

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0215-1 Rating: low References: #1124366 Cross-References: CVE-2019-7397 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issues: Security issue fixed: - CVE-2019-7397: Fixed a Memory leak in function WritePDFImage in pdf.c (bsc#1124366) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-215=1 Package List: - openSUSE Leap 15.0 (x86_64): GraphicsMagick-1.3.29-lp150.3.21.1 GraphicsMagick-debuginfo-1.3.29-lp150.3.21.1 GraphicsMagick-debugsource-1.3.29-lp150.3.21.1 GraphicsMagick-devel-1.3.29-lp150.3.21.1 libGraphicsMagick++-Q16-12-1.3.29-lp150.3.21.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.29-lp150.3.21.1 libGraphicsMagick++-devel-1.3.29-lp150.3.21.1 libGraphicsMagick-Q16-3-1.3.29-lp150.3.21.1 libGraphicsMagick-Q16-3-debuginfo-1.3.29-lp150.3.21.1 libGraphicsMagick3-config-1.3.29-lp150.3.21.1 libGraphicsMagickWand-Q16-2-1.3.29-lp150.3.21.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.29-lp150.3.21.1 perl-GraphicsMagick-1.3.29-lp150.3.21.1 perl-GraphicsMagick-debuginfo-1.3.29-lp150.3.21.1 References: https://www.suse.com/security/cve/CVE-2019-7397.html https://bugzilla.suse.com/1124366 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0212-1: moderate: Security update for pspp, spread-sheet-widget
by opensuse-security＠opensuse.org 19 Feb '19

19 Feb '19

openSUSE Security Update: Security update for pspp, spread-sheet-widget ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0212-1 Rating: moderate References: #1120061 Cross-References: CVE-2018-20230 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pspp to version 1.2.0 fixes the following issues: Security issue fixed: - CVE-2018-20230: Fixed a heap-based buffer overflow in read_bytes_internal function that could lead to denial-of-service (bsc#1120061). Other bug fixes and changes: - Add upstream patch to avoid compiling with old Texinfo 4.13. - New experimental command SAVE DATA COLLECTION to save MDD files. - MTIME and YMDHMS variable formats now supported. - Spread sheet rendering now done via spread-sheet-widget. This update introduces a new package called spread-sheet-widget as dependency. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-212=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libspread-sheet-widget0-0.3-2.1 libspread-sheet-widget0-debuginfo-0.3-2.1 spread-sheet-widget-debugsource-0.3-2.1 spread-sheet-widget-devel-0.3-2.1 - openSUSE Leap 42.3 (x86_64): pspp-1.2.0-11.1 pspp-debuginfo-1.2.0-11.1 pspp-debugsource-1.2.0-11.1 pspp-devel-1.2.0-11.1 References: https://www.suse.com/security/cve/CVE-2018-20230.html https://bugzilla.suse.com/1120061 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0214-1: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 19 Feb '19

19 Feb '19

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0214-1 Rating: low References: #1124366 Cross-References: CVE-2019-7397 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issues: Security issue fixed: - CVE-2019-7397: Fixed a Memory leak in WritePDFImage function in pdf.c (bsc#1124366). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-214=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-126.1 GraphicsMagick-debuginfo-1.3.25-126.1 GraphicsMagick-debugsource-1.3.25-126.1 GraphicsMagick-devel-1.3.25-126.1 libGraphicsMagick++-Q16-12-1.3.25-126.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-126.1 libGraphicsMagick++-devel-1.3.25-126.1 libGraphicsMagick-Q16-3-1.3.25-126.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-126.1 libGraphicsMagick3-config-1.3.25-126.1 libGraphicsMagickWand-Q16-2-1.3.25-126.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-126.1 perl-GraphicsMagick-1.3.25-126.1 perl-GraphicsMagick-debuginfo-1.3.25-126.1 References: https://www.suse.com/security/cve/CVE-2019-7397.html https://bugzilla.suse.com/1124366 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0208-1: important: Security update for runc
by opensuse-security＠opensuse.org 19 Feb '19

19 Feb '19

openSUSE Security Update: Security update for runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0208-1 Rating: important References: #1095817 #1118897 #1118898 #1118899 #1121967 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 CVE-2019-5736 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for runc fixes the following issues: Security vulnerablities addressed: - CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967) - CVE-2018-16873: Fix a remote command execution during "go get -u" (boo#1118897) - CVE-2018-16874: Fix a directory traversal in "go get" via curly braces in import paths (boo#1118898) - CVE-2018-16875: Fix a CPU denial of service issue (boo#1118899) Other changes and bug fixes: - Update go requirements to >= go1.10 - Create a symlink in /usr/bin/runc to enable rootless Podman and Buildah. - Make use of %license macro - Remove 'go test' from %check section, as it has only ever caused us problems and hasn't (as far as I remember) ever caught a release-blocking issue. Smoke testing has been far more useful. (boo#1095817) - Upgrade to runc v1.0.0~rc6. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc6 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-208=1 Package List: - openSUSE Leap 15.0 (x86_64): runc-1.0.0~rc6-lp150.2.3.1 runc-debuginfo-1.0.0~rc6-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): runc-test-1.0.0~rc6-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://www.suse.com/security/cve/CVE-2019-5736.html https://bugzilla.suse.com/1095817 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899 https://bugzilla.suse.com/1121967 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0216-1: important: Security update for chromium
by opensuse-security＠opensuse.org 19 Feb '19

19 Feb '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0216-1 Rating: important References: #1123641 #1124936 Cross-References: CVE-2019-5754 CVE-2019-5755 CVE-2019-5756 CVE-2019-5757 CVE-2019-5758 CVE-2019-5759 CVE-2019-5760 CVE-2019-5761 CVE-2019-5762 CVE-2019-5763 CVE-2019-5764 CVE-2019-5765 CVE-2019-5766 CVE-2019-5767 CVE-2019-5768 CVE-2019-5769 CVE-2019-5770 CVE-2019-5771 CVE-2019-5772 CVE-2019-5773 CVE-2019-5774 CVE-2019-5775 CVE-2019-5776 CVE-2019-5777 CVE-2019-5778 CVE-2019-5779 CVE-2019-5780 CVE-2019-5781 CVE-2019-5782 CVE-2019-5784 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 30 vulnerabilities is now available. Description: This update for Chromium to version 72.0.3626.96 fixes the following issues: Security issues fixed (bsc#1123641 and bsc#1124936): - CVE-2019-5784: Inappropriate implementation in V8 - CVE-2019-5754: Inappropriate implementation in QUIC Networking. - CVE-2019-5782: Inappropriate implementation in V8. - CVE-2019-5755: Inappropriate implementation in V8. - CVE-2019-5756: Use after free in PDFium. - CVE-2019-5757: Type Confusion in SVG. - CVE-2019-5758: Use after free in Blink. - CVE-2019-5759: Use after free in HTML select elements. - CVE-2019-5760: Use after free in WebRTC. - CVE-2019-5761: Use after free in SwiftShader. - CVE-2019-5762: Use after free in PDFium. - CVE-2019-5763: Insufficient validation of untrusted input in V8. - CVE-2019-5764: Use after free in WebRTC. - CVE-2019-5765: Insufficient policy enforcement in the browser. - CVE-2019-5766: Insufficient policy enforcement in Canvas. - CVE-2019-5767: Incorrect security UI in WebAPKs. - CVE-2019-5768: Insufficient policy enforcement in DevTools. - CVE-2019-5769: Insufficient validation of untrusted input in Blink. - CVE-2019-5770: Heap buffer overflow in WebGL. - CVE-2019-5771: Heap buffer overflow in SwiftShader. - CVE-2019-5772: Use after free in PDFium. - CVE-2019-5773: Insufficient data validation in IndexedDB. - CVE-2019-5774: Insufficient validation of untrusted input in SafeBrowsing. - CVE-2019-5775: Insufficient policy enforcement in Omnibox. - CVE-2019-5776: Insufficient policy enforcement in Omnibox. - CVE-2019-5777: Insufficient policy enforcement in Omnibox. - CVE-2019-5778: Insufficient policy enforcement in Extensions. - CVE-2019-5779: Insufficient policy enforcement in ServiceWorker. - CVE-2019-5780: Insufficient policy enforcement. - CVE-2019-5781: Insufficient policy enforcement in Omnibox. For a full list of changes refer to https://chromereleases.googleblog.com/2019/02/stable-channel-update-for-des ktop.html This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-216=1 Package List: - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-72.0.3626.96-bp150.2.32.1 chromium-72.0.3626.96-bp150.2.32.1 References: https://www.suse.com/security/cve/CVE-2019-5754.html https://www.suse.com/security/cve/CVE-2019-5755.html https://www.suse.com/security/cve/CVE-2019-5756.html https://www.suse.com/security/cve/CVE-2019-5757.html https://www.suse.com/security/cve/CVE-2019-5758.html https://www.suse.com/security/cve/CVE-2019-5759.html https://www.suse.com/security/cve/CVE-2019-5760.html https://www.suse.com/security/cve/CVE-2019-5761.html https://www.suse.com/security/cve/CVE-2019-5762.html https://www.suse.com/security/cve/CVE-2019-5763.html https://www.suse.com/security/cve/CVE-2019-5764.html https://www.suse.com/security/cve/CVE-2019-5765.html https://www.suse.com/security/cve/CVE-2019-5766.html https://www.suse.com/security/cve/CVE-2019-5767.html https://www.suse.com/security/cve/CVE-2019-5768.html https://www.suse.com/security/cve/CVE-2019-5769.html https://www.suse.com/security/cve/CVE-2019-5770.html https://www.suse.com/security/cve/CVE-2019-5771.html https://www.suse.com/security/cve/CVE-2019-5772.html https://www.suse.com/security/cve/CVE-2019-5773.html https://www.suse.com/security/cve/CVE-2019-5774.html https://www.suse.com/security/cve/CVE-2019-5775.html https://www.suse.com/security/cve/CVE-2019-5776.html https://www.suse.com/security/cve/CVE-2019-5777.html https://www.suse.com/security/cve/CVE-2019-5778.html https://www.suse.com/security/cve/CVE-2019-5779.html https://www.suse.com/security/cve/CVE-2019-5780.html https://www.suse.com/security/cve/CVE-2019-5781.html https://www.suse.com/security/cve/CVE-2019-5782.html https://www.suse.com/security/cve/CVE-2019-5784.html https://bugzilla.suse.com/1123641 https://bugzilla.suse.com/1124936 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0207-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 19 Feb '19

19 Feb '19

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0207-1 Rating: moderate References: #1118832 #1123354 #1123522 Cross-References: CVE-2018-19935 CVE-2019-6977 CVE-2019-6978 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for php7 fixes the following issues: Security issue fixed: - CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function (bsc#1123354). - CVE-2019-6978: Fixed a double free in the gdImage*Ptr() functions (bsc#1123522). - CVE-2018-19935: Fixed a Denial of Service in php_imap.c which could be triggered via an empty string in the message argument to imap_mail (bsc#1118832). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-207=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php7-7.0.7-55.1 apache2-mod_php7-debuginfo-7.0.7-55.1 php7-7.0.7-55.1 php7-bcmath-7.0.7-55.1 php7-bcmath-debuginfo-7.0.7-55.1 php7-bz2-7.0.7-55.1 php7-bz2-debuginfo-7.0.7-55.1 php7-calendar-7.0.7-55.1 php7-calendar-debuginfo-7.0.7-55.1 php7-ctype-7.0.7-55.1 php7-ctype-debuginfo-7.0.7-55.1 php7-curl-7.0.7-55.1 php7-curl-debuginfo-7.0.7-55.1 php7-dba-7.0.7-55.1 php7-dba-debuginfo-7.0.7-55.1 php7-debuginfo-7.0.7-55.1 php7-debugsource-7.0.7-55.1 php7-devel-7.0.7-55.1 php7-dom-7.0.7-55.1 php7-dom-debuginfo-7.0.7-55.1 php7-enchant-7.0.7-55.1 php7-enchant-debuginfo-7.0.7-55.1 php7-exif-7.0.7-55.1 php7-exif-debuginfo-7.0.7-55.1 php7-fastcgi-7.0.7-55.1 php7-fastcgi-debuginfo-7.0.7-55.1 php7-fileinfo-7.0.7-55.1 php7-fileinfo-debuginfo-7.0.7-55.1 php7-firebird-7.0.7-55.1 php7-firebird-debuginfo-7.0.7-55.1 php7-fpm-7.0.7-55.1 php7-fpm-debuginfo-7.0.7-55.1 php7-ftp-7.0.7-55.1 php7-ftp-debuginfo-7.0.7-55.1 php7-gd-7.0.7-55.1 php7-gd-debuginfo-7.0.7-55.1 php7-gettext-7.0.7-55.1 php7-gettext-debuginfo-7.0.7-55.1 php7-gmp-7.0.7-55.1 php7-gmp-debuginfo-7.0.7-55.1 php7-iconv-7.0.7-55.1 php7-iconv-debuginfo-7.0.7-55.1 php7-imap-7.0.7-55.1 php7-imap-debuginfo-7.0.7-55.1 php7-intl-7.0.7-55.1 php7-intl-debuginfo-7.0.7-55.1 php7-json-7.0.7-55.1 php7-json-debuginfo-7.0.7-55.1 php7-ldap-7.0.7-55.1 php7-ldap-debuginfo-7.0.7-55.1 php7-mbstring-7.0.7-55.1 php7-mbstring-debuginfo-7.0.7-55.1 php7-mcrypt-7.0.7-55.1 php7-mcrypt-debuginfo-7.0.7-55.1 php7-mysql-7.0.7-55.1 php7-mysql-debuginfo-7.0.7-55.1 php7-odbc-7.0.7-55.1 php7-odbc-debuginfo-7.0.7-55.1 php7-opcache-7.0.7-55.1 php7-opcache-debuginfo-7.0.7-55.1 php7-openssl-7.0.7-55.1 php7-openssl-debuginfo-7.0.7-55.1 php7-pcntl-7.0.7-55.1 php7-pcntl-debuginfo-7.0.7-55.1 php7-pdo-7.0.7-55.1 php7-pdo-debuginfo-7.0.7-55.1 php7-pgsql-7.0.7-55.1 php7-pgsql-debuginfo-7.0.7-55.1 php7-phar-7.0.7-55.1 php7-phar-debuginfo-7.0.7-55.1 php7-posix-7.0.7-55.1 php7-posix-debuginfo-7.0.7-55.1 php7-pspell-7.0.7-55.1 php7-pspell-debuginfo-7.0.7-55.1 php7-readline-7.0.7-55.1 php7-readline-debuginfo-7.0.7-55.1 php7-shmop-7.0.7-55.1 php7-shmop-debuginfo-7.0.7-55.1 php7-snmp-7.0.7-55.1 php7-snmp-debuginfo-7.0.7-55.1 php7-soap-7.0.7-55.1 php7-soap-debuginfo-7.0.7-55.1 php7-sockets-7.0.7-55.1 php7-sockets-debuginfo-7.0.7-55.1 php7-sqlite-7.0.7-55.1 php7-sqlite-debuginfo-7.0.7-55.1 php7-sysvmsg-7.0.7-55.1 php7-sysvmsg-debuginfo-7.0.7-55.1 php7-sysvsem-7.0.7-55.1 php7-sysvsem-debuginfo-7.0.7-55.1 php7-sysvshm-7.0.7-55.1 php7-sysvshm-debuginfo-7.0.7-55.1 php7-tidy-7.0.7-55.1 php7-tidy-debuginfo-7.0.7-55.1 php7-tokenizer-7.0.7-55.1 php7-tokenizer-debuginfo-7.0.7-55.1 php7-wddx-7.0.7-55.1 php7-wddx-debuginfo-7.0.7-55.1 php7-xmlreader-7.0.7-55.1 php7-xmlreader-debuginfo-7.0.7-55.1 php7-xmlrpc-7.0.7-55.1 php7-xmlrpc-debuginfo-7.0.7-55.1 php7-xmlwriter-7.0.7-55.1 php7-xmlwriter-debuginfo-7.0.7-55.1 php7-xsl-7.0.7-55.1 php7-xsl-debuginfo-7.0.7-55.1 php7-zip-7.0.7-55.1 php7-zip-debuginfo-7.0.7-55.1 php7-zlib-7.0.7-55.1 php7-zlib-debuginfo-7.0.7-55.1 - openSUSE Leap 42.3 (noarch): php7-pear-7.0.7-55.1 php7-pear-Archive_Tar-7.0.7-55.1 References: https://www.suse.com/security/cve/CVE-2018-19935.html https://www.suse.com/security/cve/CVE-2019-6977.html https://www.suse.com/security/cve/CVE-2019-6978.html https://bugzilla.suse.com/1118832 https://bugzilla.suse.com/1123354 https://bugzilla.suse.com/1123522 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0205-1: important: Security update for chromium
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0205-1 Rating: important References: #1123641 #1124936 Cross-References: CVE-2019-5754 CVE-2019-5755 CVE-2019-5756 CVE-2019-5757 CVE-2019-5758 CVE-2019-5759 CVE-2019-5760 CVE-2019-5761 CVE-2019-5762 CVE-2019-5763 CVE-2019-5764 CVE-2019-5765 CVE-2019-5766 CVE-2019-5767 CVE-2019-5768 CVE-2019-5769 CVE-2019-5770 CVE-2019-5771 CVE-2019-5772 CVE-2019-5773 CVE-2019-5774 CVE-2019-5775 CVE-2019-5776 CVE-2019-5777 CVE-2019-5778 CVE-2019-5779 CVE-2019-5780 CVE-2019-5781 CVE-2019-5782 CVE-2019-5784 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 30 vulnerabilities is now available. Description: This update for Chromium to version 72.0.3626.96 fixes the following issues: Security issues fixed (bsc#1123641 and bsc#1124936): - CVE-2019-5784: Inappropriate implementation in V8 - CVE-2019-5754: Inappropriate implementation in QUIC Networking. - CVE-2019-5782: Inappropriate implementation in V8. - CVE-2019-5755: Inappropriate implementation in V8. - CVE-2019-5756: Use after free in PDFium. - CVE-2019-5757: Type Confusion in SVG. - CVE-2019-5758: Use after free in Blink. - CVE-2019-5759: Use after free in HTML select elements. - CVE-2019-5760: Use after free in WebRTC. - CVE-2019-5761: Use after free in SwiftShader. - CVE-2019-5762: Use after free in PDFium. - CVE-2019-5763: Insufficient validation of untrusted input in V8. - CVE-2019-5764: Use after free in WebRTC. - CVE-2019-5765: Insufficient policy enforcement in the browser. - CVE-2019-5766: Insufficient policy enforcement in Canvas. - CVE-2019-5767: Incorrect security UI in WebAPKs. - CVE-2019-5768: Insufficient policy enforcement in DevTools. - CVE-2019-5769: Insufficient validation of untrusted input in Blink. - CVE-2019-5770: Heap buffer overflow in WebGL. - CVE-2019-5771: Heap buffer overflow in SwiftShader. - CVE-2019-5772: Use after free in PDFium. - CVE-2019-5773: Insufficient data validation in IndexedDB. - CVE-2019-5774: Insufficient validation of untrusted input in SafeBrowsing. - CVE-2019-5775: Insufficient policy enforcement in Omnibox. - CVE-2019-5776: Insufficient policy enforcement in Omnibox. - CVE-2019-5777: Insufficient policy enforcement in Omnibox. - CVE-2019-5778: Insufficient policy enforcement in Extensions. - CVE-2019-5779: Insufficient policy enforcement in ServiceWorker. - CVE-2019-5780: Insufficient policy enforcement. - CVE-2019-5781: Insufficient policy enforcement in Omnibox. For a full list of changes refer to https://chromereleases.googleblog.com/2019/02/stable-channel-update-for-des ktop.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-205=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-72.0.3626.96-197.1 chromedriver-debuginfo-72.0.3626.96-197.1 chromium-72.0.3626.96-197.1 chromium-debuginfo-72.0.3626.96-197.1 chromium-debugsource-72.0.3626.96-197.1 References: https://www.suse.com/security/cve/CVE-2019-5754.html https://www.suse.com/security/cve/CVE-2019-5755.html https://www.suse.com/security/cve/CVE-2019-5756.html https://www.suse.com/security/cve/CVE-2019-5757.html https://www.suse.com/security/cve/CVE-2019-5758.html https://www.suse.com/security/cve/CVE-2019-5759.html https://www.suse.com/security/cve/CVE-2019-5760.html https://www.suse.com/security/cve/CVE-2019-5761.html https://www.suse.com/security/cve/CVE-2019-5762.html https://www.suse.com/security/cve/CVE-2019-5763.html https://www.suse.com/security/cve/CVE-2019-5764.html https://www.suse.com/security/cve/CVE-2019-5765.html https://www.suse.com/security/cve/CVE-2019-5766.html https://www.suse.com/security/cve/CVE-2019-5767.html https://www.suse.com/security/cve/CVE-2019-5768.html https://www.suse.com/security/cve/CVE-2019-5769.html https://www.suse.com/security/cve/CVE-2019-5770.html https://www.suse.com/security/cve/CVE-2019-5771.html https://www.suse.com/security/cve/CVE-2019-5772.html https://www.suse.com/security/cve/CVE-2019-5773.html https://www.suse.com/security/cve/CVE-2019-5774.html https://www.suse.com/security/cve/CVE-2019-5775.html https://www.suse.com/security/cve/CVE-2019-5776.html https://www.suse.com/security/cve/CVE-2019-5777.html https://www.suse.com/security/cve/CVE-2019-5778.html https://www.suse.com/security/cve/CVE-2019-5779.html https://www.suse.com/security/cve/CVE-2019-5780.html https://www.suse.com/security/cve/CVE-2019-5781.html https://www.suse.com/security/cve/CVE-2019-5782.html https://www.suse.com/security/cve/CVE-2019-5784.html https://bugzilla.suse.com/1123641 https://bugzilla.suse.com/1124936 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0201-1: important: Security update for docker-runc
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for docker-runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0201-1 Rating: important References: #1121967 Cross-References: CVE-2019-5736 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for docker-runc fixes the following issues: Security issue fixed: - CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-201=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): docker-runc-1.0.0rc5+gitr3562_69663f0bd4b6-8.1 docker-runc-debuginfo-1.0.0rc5+gitr3562_69663f0bd4b6-8.1 docker-runc-debugsource-1.0.0rc5+gitr3562_69663f0bd4b6-8.1 docker-runc-kubic-1.0.0rc5+gitr3562_69663f0bd4b6-8.1 docker-runc-kubic-debuginfo-1.0.0rc5+gitr3562_69663f0bd4b6-8.1 docker-runc-kubic-debugsource-1.0.0rc5+gitr3562_69663f0bd4b6-8.1 - openSUSE Leap 42.3 (noarch): docker-runc-kubic-test-1.0.0rc5+gitr3562_69663f0bd4b6-8.1 docker-runc-test-1.0.0rc5+gitr3562_69663f0bd4b6-8.1 References: https://www.suse.com/security/cve/CVE-2019-5736.html https://bugzilla.suse.com/1121967 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0204-1: important: Security update for chromium
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0204-1 Rating: important References: #1123641 #1124936 Cross-References: CVE-2019-5754 CVE-2019-5755 CVE-2019-5756 CVE-2019-5757 CVE-2019-5758 CVE-2019-5759 CVE-2019-5760 CVE-2019-5761 CVE-2019-5762 CVE-2019-5763 CVE-2019-5764 CVE-2019-5765 CVE-2019-5766 CVE-2019-5767 CVE-2019-5768 CVE-2019-5769 CVE-2019-5770 CVE-2019-5771 CVE-2019-5772 CVE-2019-5773 CVE-2019-5774 CVE-2019-5775 CVE-2019-5776 CVE-2019-5777 CVE-2019-5778 CVE-2019-5779 CVE-2019-5780 CVE-2019-5781 CVE-2019-5782 CVE-2019-5784 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 30 vulnerabilities is now available. Description: This update for Chromium to version 72.0.3626.96 fixes the following issues: Security issues fixed (bsc#1123641 and bsc#1124936): - CVE-2019-5784: Inappropriate implementation in V8 - CVE-2019-5754: Inappropriate implementation in QUIC Networking. - CVE-2019-5782: Inappropriate implementation in V8. - CVE-2019-5755: Inappropriate implementation in V8. - CVE-2019-5756: Use after free in PDFium. - CVE-2019-5757: Type Confusion in SVG. - CVE-2019-5758: Use after free in Blink. - CVE-2019-5759: Use after free in HTML select elements. - CVE-2019-5760: Use after free in WebRTC. - CVE-2019-5761: Use after free in SwiftShader. - CVE-2019-5762: Use after free in PDFium. - CVE-2019-5763: Insufficient validation of untrusted input in V8. - CVE-2019-5764: Use after free in WebRTC. - CVE-2019-5765: Insufficient policy enforcement in the browser. - CVE-2019-5766: Insufficient policy enforcement in Canvas. - CVE-2019-5767: Incorrect security UI in WebAPKs. - CVE-2019-5768: Insufficient policy enforcement in DevTools. - CVE-2019-5769: Insufficient validation of untrusted input in Blink. - CVE-2019-5770: Heap buffer overflow in WebGL. - CVE-2019-5771: Heap buffer overflow in SwiftShader. - CVE-2019-5772: Use after free in PDFium. - CVE-2019-5773: Insufficient data validation in IndexedDB. - CVE-2019-5774: Insufficient validation of untrusted input in SafeBrowsing. - CVE-2019-5775: Insufficient policy enforcement in Omnibox. - CVE-2019-5776: Insufficient policy enforcement in Omnibox. - CVE-2019-5777: Insufficient policy enforcement in Omnibox. - CVE-2019-5778: Insufficient policy enforcement in Extensions. - CVE-2019-5779: Insufficient policy enforcement in ServiceWorker. - CVE-2019-5780: Insufficient policy enforcement. - CVE-2019-5781: Insufficient policy enforcement in Omnibox. For a full list of changes refer to https://chromereleases.googleblog.com/2019/02/stable-channel-update-for-des ktop.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-204=1 Package List: - openSUSE Leap 15.0 (x86_64): chromedriver-72.0.3626.96-lp150.2.41.1 chromedriver-debuginfo-72.0.3626.96-lp150.2.41.1 chromium-72.0.3626.96-lp150.2.41.1 chromium-debuginfo-72.0.3626.96-lp150.2.41.1 chromium-debugsource-72.0.3626.96-lp150.2.41.1 References: https://www.suse.com/security/cve/CVE-2019-5754.html https://www.suse.com/security/cve/CVE-2019-5755.html https://www.suse.com/security/cve/CVE-2019-5756.html https://www.suse.com/security/cve/CVE-2019-5757.html https://www.suse.com/security/cve/CVE-2019-5758.html https://www.suse.com/security/cve/CVE-2019-5759.html https://www.suse.com/security/cve/CVE-2019-5760.html https://www.suse.com/security/cve/CVE-2019-5761.html https://www.suse.com/security/cve/CVE-2019-5762.html https://www.suse.com/security/cve/CVE-2019-5763.html https://www.suse.com/security/cve/CVE-2019-5764.html https://www.suse.com/security/cve/CVE-2019-5765.html https://www.suse.com/security/cve/CVE-2019-5766.html https://www.suse.com/security/cve/CVE-2019-5767.html https://www.suse.com/security/cve/CVE-2019-5768.html https://www.suse.com/security/cve/CVE-2019-5769.html https://www.suse.com/security/cve/CVE-2019-5770.html https://www.suse.com/security/cve/CVE-2019-5771.html https://www.suse.com/security/cve/CVE-2019-5772.html https://www.suse.com/security/cve/CVE-2019-5773.html https://www.suse.com/security/cve/CVE-2019-5774.html https://www.suse.com/security/cve/CVE-2019-5775.html https://www.suse.com/security/cve/CVE-2019-5776.html https://www.suse.com/security/cve/CVE-2019-5777.html https://www.suse.com/security/cve/CVE-2019-5778.html https://www.suse.com/security/cve/CVE-2019-5779.html https://www.suse.com/security/cve/CVE-2019-5780.html https://www.suse.com/security/cve/CVE-2019-5781.html https://www.suse.com/security/cve/CVE-2019-5782.html https://www.suse.com/security/cve/CVE-2019-5784.html https://bugzilla.suse.com/1123641 https://bugzilla.suse.com/1124936 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0203-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0203-1 Rating: important References: #1046306 #1050252 #1051510 #1054610 #1055121 #1056658 #1056662 #1084216 #1086301 #1086313 #1086314 #1086323 #1087082 #1087092 #1098382 #1098425 #1104353 #1106105 #1106434 #1106811 #1108870 #1109695 #1110705 #1111666 #1113712 #1113722 #1114279 #1117155 #1118338 #1118505 #1119086 #1119766 #1120318 #1120758 #1120854 #1120902 #1120954 #1120955 #1121599 #1121726 #1121973 #1122019 #1122324 #1122554 #1122662 #1122779 #1122885 #1122927 #1122944 #1122971 #1123061 #1123317 #1123348 #1123357 #1123538 #1123697 #1123933 #1124204 #1124579 #1124589 #1124728 #1124732 #1124735 #1124969 #1124985 #1125109 #802154 Cross-References: CVE-2018-20669 CVE-2019-3459 CVE-2019-3460 CVE-2019-6974 CVE-2019-7221 CVE-2019-7222 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has 61 fixes is now available. Description: The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2019-3459,CVE-2019-3460: Two information leaks in the bluetooth stack were fixed. (bnc#1120758). - CVE-2019-7221: A use-after-free in the KVM nVMX hrtimer was fixed. (bnc#1124732). - CVE-2019-7222: A information leak in exception handling in KVM could be used to expose host memory to guests. (bnc#1124735). - CVE-2019-6974: A use-after-free in the KVM device control API was fixed. (bnc#1124728). - CVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915 driver were fixed which might have lead to information leaks. (bnc#1122971). The following non-security bugs were fixed: - 6lowpan: iphc: reset mac_header after decompress to fix panic (bsc#1051510). - 9p: clear dangling pointers in p9stat_free (bsc#1051510). - 9p locks: fix glock.client_id leak in do_lock (bsc#1051510). - 9p/net: put a lower bound on msize (bsc#1051510). - acpi/nfit: Block function zero DSMs (bsc#1051510). - acpi, nfit: Fix Address Range Scrub completion tracking (bsc#1124969). - acpi/nfit: Fix command-supported detection (bsc#1051510). - acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id() (bsc#1122662). - acpi/nfit: Fix user-initiated ARS to be "ARS-long" rather than "ARS-short" (bsc#1124969). - ACPI: power: Skip duplicate power resource references in _PRx (bsc#1051510). - Add delay-init quirk for Corsair K70 RGB keyboards (bsc#1087092). - af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers (bsc#1051510). - alsa: bebob: fix model-id of unit for Apogee Ensemble (bsc#1051510). - alsa: compress: Fix stop handling on compressed capture streams (bsc#1051510). - alsa: hda - Add mute LED support for HP ProBook 470 G5 (bsc#1051510). - alsa: hda/ca0132 - Fix build error without CONFIG_PCI (bsc#1051510). - alsa: hda/realtek - Fixed hp_pin no value (bsc#1051510). - alsa: hda/realtek - Fix lose hp_pins for disable auto mute (bsc#1051510). - alsa: hda/realtek - Use a common helper for hp pin reference (bsc#1051510). - alsa: hda - Serialize codec registrations (bsc#1122944). - alsa: hda - Use standard device registration for beep (bsc#1122944). - alsa: oxfw: add support for APOGEE duet FireWire (bsc#1051510). - alsa: usb-audio: Add Opus #3 to quirks for native DSD support (bsc#1051510). - alsa: usb-audio: Add support for new T+A USB DAC (bsc#1051510). - amd-xgbe: Fix mdio access for non-zero ports and clause 45 PHYs (bsc#1122927). - arm: 8802/1: Call syscall_trace_exit even when system call skipped (bsc#1051510). - arm: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling (bsc#1051510). - arm: 8815/1: V7M: align v7m_dma_inv_range() with v7 counterpart (bsc#1051510). - arm/arm64: kvm:vgic: Force VM halt when changing the active state of GICv3 PPIs/SGIs (bsc#1051510). - arm: cns3xxx: Fix writing to wrong PCI config registers after alignment (bsc#1051510). - arm: cns3xxx: Use actual size reads for PCIe (bsc#1051510). - arm: imx: update the cpu power up timing setting on i.mx6sx (bsc#1051510). - arm: kvm:Fix VTTBR_BADDR_MASK BUG_ON off-by-one (bsc#1051510). - arm: mmp/mmp2: fix cpu_is_mmp2() on mmp2-dt (bsc#1051510). - arm: OMAP1: ams-delta: Fix possible use of uninitialized field (bsc#1051510). - arm: OMAP2+: prm44xx: Fix section annotation on omap44xx_prm_enable_io_wakeup (bsc#1051510). - ASoC: dma-sh7760: cleanup a debug printk (bsc#1051510). - ASoC: rt5514-spi: Fix potential NULL pointer dereference (bsc#1051510). - ax25: fix a use-after-free in ax25_fillin_cb() (networking-stable-19_01_04). - be2net: do not flip hw_features when VXLANs are added/deleted (bsc#1050252). - blkdev: avoid migration stalls for blkdev pages (bsc#1084216). - blk-mq: fix kernel oops in blk_mq_tag_idle() (bsc#1051510). - block: break discard submissions into the user defined size (git-fixes). - block: cleanup __blkdev_issue_discard() (git-fixes). - block: do not deal with discard limit in blkdev_issue_discard() (git-fixes). - block: fix 32 bit overflow in __blkdev_issue_discard() (git-fixes). - block: fix infinite loop if the device loses discard capability (git-fixes). - block: make sure discard bio is aligned with logical block size (git-fixes). - block: make sure writesame bio is aligned with logical block size (git-fixes). - block/swim3: Fix -EBUSY error when re-opening device after unmount (git-fixes). - bnx2x: Assign unique DMAE channel number for FW DMAE transactions (bsc#1086323). - bnx2x: Clear fip MAC when fcoe offload support is disabled (bsc#1086323). - bnx2x: Fix NULL pointer dereference in bnx2x_del_all_vlans() on some hw (bsc#1086323). - bnx2x: Remove configured vlans as part of unload sequence (bsc#1086323). - bnx2x: Send update-svid ramrod with retry/poll flags enabled (bsc#1086323). - bonding: update nest level on unlink (git-fixes). - bsg: allocate sense buffer if requested (bsc#1106811). - btrfs: qgroup: Fix root item corruption when multiple same source snapshots are created with quota enabled (bsc#1122324). - can: bcm: check timer values before ktime conversion (bsc#1051510). - can: dev: __can_get_echo_skb(): fix bogous check for non-existing skb by removing it (bsc#1051510). - can: gw: ensure DLC boundaries after CAN frame modification (bsc#1051510). - cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader (bsc#1051510). - char/mwave: fix potential Spectre v1 vulnerability (bsc#1051510). - checkstack.pl: fix for aarch64 (bsc#1051510). - cifs: add missing debug entries for kconfig options (bsc#1051510). - cifs: add missing support for ACLs in SMB 3.11 (bsc#1051510). - cifs: add sha512 secmech (bsc#1051510). - cifs: Add support for reading attributes on SMB2+ (bsc#1051510). - cifs: Add support for writing attributes on SMB2+ (bsc#1051510). - cifs: do not log STATUS_NOT_FOUND errors for DFS (bsc#1051510). - cifs: Do not modify mid entry after submitting I/O in cifs_call_async (bsc#1051510). - cifs: Fix error mapping for SMB2_LOCK command which caused OFD lock problem (bsc#1051510). - cifs: Fix memory leak in smb2_set_ea() (bsc#1051510). - cifs: fix return value for cifs_listxattr (bsc#1051510). - cifs: Fix separator when building path from dentry (bsc#1051510). - cifs: fix set info (bsc#1051510). - cifs: fix sha512 check in cifs_crypto_secmech_release (bsc#1051510). - cifs: fix wrapping bugs in num_entries() (bsc#1051510). - cifs: For SMB2 security informaion query, check for minimum sized security descriptor instead of sizeof FileAllInformation class (bsc#1051510). - cifs: hide unused functions (bsc#1051510). - cifs: hide unused functions (bsc#1051510). - cifs: implement v3.11 preauth integrity (bsc#1051510). - cifs: make 'nodfs' mount opt a superblock flag (bsc#1051510). - cifs: prevent integer overflow in nxt_dir_entry() (bsc#1051510). - cifs: prototype declaration and definition for smb 2 - 3 and cifsacl mount options (bsc#1051510). - cifs: prototype declaration and definition to set acl for smb 2 - 3 and cifsacl mount options (bsc#1051510). - cifs: refactor crypto shash/sdesc allocation&free (bsc#1051510). - cifs: smb2ops: Fix listxattr() when there are no EAs (bsc#1051510). - cifs: Use smb 2 - 3 and cifsacl mount options getacl functions (bsc#1051510). - cifs: Use smb 2 - 3 and cifsacl mount options setacl function (bsc#1051510). - cifs: Use ULL suffix for 64-bit constant (bsc#1051510). - clk: imx6q: reset exclusive gates on init (bsc#1051510). - clk: rockchip: fix typo in rk3188 spdif_frac parent (bsc#1051510). - clk: sunxi-ng: enable so-said LDOs for A64 SoC's pll-mipi clock (bsc#1051510). - clk: sunxi-ng: h3/h5: Fix CSI_MCLK parent (bsc#1051510). - cpufreq: imx6q: add return value check for voltage scale (bsc#1051510). - Cramfs: fix abad comparison when wrap-arounds occur (bsc#1051510). - crypto: authencesn - Avoid twice completion call in decrypt path (bsc#1051510). - crypto: authenc - fix parsing key with misaligned rta_len (bsc#1051510). - crypto: bcm - convert to use crypto_authenc_extractkeys() (bsc#1051510). - crypto: caam - fix zero-length buffer DMA mapping (bsc#1051510). - crypto: user - support incremental algorithm dumps (bsc#1120902). - dlm: fixed memory leaks after failed ls_remove_names allocation (bsc#1051510). - dlm: lost put_lkb on error path in receive_convert() and receive_unlock() (bsc#1051510). - dlm: memory leaks on error path in dlm_user_request() (bsc#1051510). - dlm: possible memory leak on error path in create_lkb() (bsc#1051510). - dmaengine: at_hdmac: fix memory leak in at_dma_xlate() (bsc#1051510). - dmaengine: at_hdmac: fix module unloading (bsc#1051510). - dmaengine: dma-jz4780: Return error if not probed from DT (bsc#1051510). - dmaengine: dw: Fix FIFO size for Intel Merrifield (bsc#1051510). - dmaengine: xilinx_dma: Remove __aligned attribute on zynqmp_dma_desc_ll (bsc#1051510). - dm cache metadata: verify cache has blocks in blocks_are_clean_separate_dirty() (git-fixes). - dm: call blk_queue_split() to impose device limits on bios (git-fixes). - dm: do not allow readahead to limit IO size (git-fixes). - dm thin: send event about thin-pool state change _after_ making it (git-fixes). - dm zoned: Fix target BIO completion handling (git-fixes). - Do not log expected error on DFS referral request (bsc#1051510). - driver core: Move async_synchronize_full call (bsc#1051510). - drivers: core: Remove glue dirs from sysfs earlier (bsc#1051510). - drivers/misc/sgi-gru: fix Spectre v1 vulnerability (bsc#1051510). - drivers/net/ethernet/qlogic/qed/qed_rdma.h: fix typo (bsc#1086314 bsc#1086313 bsc#1086301 ). - drivers/sbus/char: add of_node_put() (bsc#1051510). - drivers/tty: add missing of_node_put() (bsc#1051510). - drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock (bsc#1113722) - drm/fb-helper: Partially bring back workaround for bugs of SDL 1.2 (bsc#1113722) - drm/i915/gvt: Fix mmap range check (bsc#1120902) - drm/nouveau/tmr: detect stalled gpu timer and break out of waits (bsc#1123538). - drm/vmwgfx: Fix setting of dma masks (bsc#1120902) - drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user (bsc#1120902) - e1000e: allow non-monotonic SYSTIM readings (bsc#1051510). - exportfs: do not read dentry after free (bsc#1051510). - ext4: Fix crash during online resizing (bsc#1122779). - fanotify: fix handling of events on child sub-directory (bsc#1122019). - fat: validate ->i_start before using (bsc#1051510). - fix smb3-encryption breakage when CONFIG_DEBUG_SG=y (bsc#1051510). - fork: do not copy inconsistent signal handler state to child (bsc#1051510). - fork: record start_time late (git-fixes). - fork: unconditionally clear stack on fork (git-fixes). - fs/cifs: require sha512 (bsc#1051510). - gpio: altera-a10sr: Set proper output level for direction_output (bsc#1051510). - gpio: pcf857x: Fix interrupts on multiple instances (bsc#1051510). - gpio: pl061: handle failed allocations (bsc#1051510). - gpio: pl061: Move irq_chip definition inside struct pl061 (bsc#1051510). - gpio: vf610: Mask all GPIO interrupts (bsc#1051510). - gro_cell: add napi_disable in gro_cells_destroy (networking-stable-19_01_04). - hfs: do not free node before using (bsc#1051510). - hfsplus: do not free node before using (bsc#1051510). - hfsplus: prevent btree data loss on root split (bsc#1051510). - hfs: prevent btree data loss on root split (bsc#1051510). - i2c: dev: prevent adapter retries and timeout being set as minus value (bsc#1051510). - i40e: fix mac filter delete when setting mac address (bsc#1056658 bsc#1056662). - i40e: report correct statistics when XDP is enabled (bsc#1056658 bsc#1056662). - i40e: restore NETIF_F_GSO_IPXIP to netdev features (bsc#1056658 bsc#1056662). - ibmveth: Do not process frames after calling napi_reschedule (bcs#1123357). - ibmveth: fix DMA unmap error in ibmveth_xmit_start error path (networking-stable-19_01_04). - ibmvnic: Add ethtool private flag for driver-defined queue limits (bsc#1121726). - ibmvnic: Increase maximum queue size limit (bsc#1121726). - ibmvnic: Introduce driver limits for ring sizes (bsc#1121726). - ide: pmac: add of_node_put() (bsc#1051510). - ieee802154: lowpan_header_create check must check daddr (networking-stable-19_01_04). - input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G (bsc#1051510). - input: omap-keypad - fix idle configuration to not block SoC idle states (bsc#1051510). - input: raspberrypi-ts - fix link error (git-fixes). - input: restore EV_ABS ABS_RESERVED (bsc#1051510). - input: synaptics - enable RMI on ThinkPad T560 (bsc#1051510). - input: synaptics - enable SMBus for HP EliteBook 840 G4 (bsc#1051510). - input: xpad - add support for SteelSeries Stratus Duo (bsc#1111666). - iommu/amd: Call free_iova_fast with pfn in map_sg (bsc#1106105). - iommu/amd: Fix IOMMU page flush when detach device from a domain (bsc#1106105). - iommu/amd: Unmap all mapped pages in error path of map_sg (bsc#1106105). - iommu/vt-d: Fix memory leak in intel_iommu_put_resv_regions() (bsc#1106105). - ip6mr: Fix potential Spectre v1 vulnerability (networking-stable-19_01_04). - ipmi:pci: Blacklist a Realtek "IPMI" device (git-fixes). - ipmi:ssif: Fix handling of multi-part return messages (bsc#1051510). - ip: on queued skb use skb_header_pointer instead of pskb_may_pull (git-fixes). - ipv4: Fix potential Spectre v1 vulnerability (networking-stable-19_01_04). - ipv4: ipv6: netfilter: Adjust the frag mem limit when truesize changes (networking-stable-18_12_12). - ipv6: Check available headroom in ip6_xmit() even without options (networking-stable-18_12_12). - ipv6: explicitly initialize udp6_addr in udp_sock_create6() (networking-stable-19_01_04). - ipv6: sr: properly initialize flowi6 prior passing to ip6_route_output (networking-stable-18_12_12). - ipv6: tunnels: fix two use-after-free (networking-stable-19_01_04). - ip: validate header length on virtual device xmit (networking-stable-19_01_04). - iscsi target: fix session creation failure handling (bsc#1051510). - isdn: fix kernel-infoleak in capi_unlocked_ioctl (bsc#1051510). - iwlwifi: fix non_shared_ant for 22000 devices (bsc#1119086). - iwlwifi: fix wrong WGDS_WIFI_DATA_SIZE (bsc#1119086). - iwlwifi: mvm: do not send GEO_TX_POWER_LIMIT to old firmwares (bsc#1119086). - jffs2: Fix use of uninitialized delayed_work, lockdep breakage (bsc#1051510). - kABI: fix xhci kABI stability (bsc#1119086). - kABI: protect struct sctp_association (kabi). - kABI workaround for deleted snd_hda_register_beep_device() (bsc#1122944). - kABI workaround for snd_hda_bus.bus_probing addition (bsc#1122944). - kdb: use memmove instead of overlapping memcpy (bsc#1120954). - kernel/exit.c: release ptraced tasks before zap_pid_ns_processes (git-fixes). - kvm: arm/arm64: Properly protect VGIC locks from IRQs (bsc#1117155). - kvm: arm/arm64: VGIC/ITS: Promote irq_lock() in update_affinity (bsc#1117155). - kvm: arm/arm64: VGIC/ITS: protect kvm_read_guest() calls with SRCU lock (bsc#1117155). - kvm: arm/arm64: VGIC/ITS save/restore: protect kvm_read_guest() calls (bsc#1117155). - kvm: PPC: Book3S PR: Set hflag to indicate that POWER9 supports 1T segments (bsc#1124589). - kvm: sev: Fail KVM_SEV_INIT if already initialized (bsc#1114279). - kvm: x86: fix L1TF's MMIO GFN calculation (bsc#1124204). - lan78xx: Resolve issue with changing MAC address (bsc#1051510). - libertas_tf: prevent underflow in process_cmdrequest() (bsc#1119086). - lib/rbtree-test: lower default params (git-fixes). - lockd: fix access beyond unterminated strings in prints (git-fixes). - LSM: Check for NULL cred-security on free (bsc#1051510). - md: fix raid10 hang issue caused by barrier (git-fixes). - media: firewire: Fix app_info parameter type in avc_ca{,_app}_info (bsc#1051510). - media: usb: pwc: Do not use coherent DMA buffers for ISO transfer (bsc#1054610). - media: v4l2-tpg: array index could become negative (bsc#1051510). - media: v4l: ioctl: Validate num_planes for debug messages (bsc#1051510). - media: vb2: be sure to unlock mutex on errors (bsc#1051510). - media: vb2: vb2_mmap: move lock up (bsc#1051510). - media: vivid: fix error handling of kthread_run (bsc#1051510). - media: vivid: free bitmap_cap when updating std/timings/etc (bsc#1051510). - media: vivid: set min width/height to a value > 0 (bsc#1051510). - mfd: ab8500-core: Return zero in get_register_interruptible() (bsc#1051510). - mfd: tps6586x: Handle interrupts on suspend (bsc#1051510). - misc: atmel-ssc: Fix section annotation on atmel_ssc_get_driver_data (bsc#1051510). - misc: hmc6352: fix potential Spectre v1 (bsc#1051510). - misc: mic/scif: fix copy-paste error in scif_create_remote_lookup (bsc#1051510). - misc: mic: SCIF Fix scif_get_new_port() error handling (bsc#1051510). - misc: sram: enable clock before registering regions (bsc#1051510). - misc: sram: fix resource leaks in probe error path (bsc#1051510). - misc: ti-st: Fix memory leak in the error path of probe() (bsc#1051510). - misc: vexpress: Off by one in vexpress_syscfg_exec() (bsc#1051510). - mmc: atmel-mci: do not assume idle after atmci_request_end (bsc#1051510). - mmc: bcm2835: Fix DMA channel leak on probe error (bsc#1051510). - mmc: dw_mmc-bluefield: : Fix the license information (bsc#1051510). - mmc: sdhci-iproc: handle mmc_of_parse() errors during probe (bsc#1051510). - mm/huge_memory: fix lockdep complaint on 32-bit i_size_read() (VM Functionality, bsc#1121599). - mm/huge_memory: rename freeze_page() to unmap_page() (VM Functionality, bsc#1121599). - mm/huge_memory: splitting set mapping+index before unfreeze (VM Functionality, bsc#1121599). - mm/khugepaged: collapse_shmem() do not crash on Compound (VM Functionality, bsc#1121599). - mm/khugepaged: collapse_shmem() remember to clear holes (VM Functionality, bsc#1121599). - mm/khugepaged: collapse_shmem() stop if punched or truncated (VM Functionality, bsc#1121599). - mm/khugepaged: collapse_shmem() without freezing new_page (VM Functionality, bsc#1121599). - mm/khugepaged: fix crashes due to misaccounted holes (VM Functionality, bsc#1121599). - mm/khugepaged: minor reorderings in collapse_shmem() (VM Functionality, bsc#1121599). - mm: migrate: lock buffers before migrate_page_move_mapping() (bsc#1084216). - mm: migrate: Make buffer_migrate_page_norefs() actually succeed (bsc#1084216) - mm: migrate: provide buffer_migrate_page_norefs() (bsc#1084216). - mm: migration: factor out code to compute expected number of page references (bsc#1084216). - Move the upstreamed HD-audio fix into sorted section - mpt3sas: check sense buffer before copying sense data (bsc#1106811). - neighbour: Avoid writing before skb->head in neigh_hh_output() (networking-stable-18_12_12). - net: 8139cp: fix a BUG triggered by changing mtu with network traffic (networking-stable-18_12_12). - net: core: Fix Spectre v1 vulnerability (networking-stable-19_01_04). - net/hamradio/6pack: use mod_timer() to rearm timers (networking-stable-19_01_04). - net: hns3: add error handler for hns3_nic_init_vector_data() (bsc#1104353). - net: hns3: add handling for big TX fragment (bsc#1104353 ). - net: hns3: Fix client initialize state issue when roce client initialize failed (bsc#1104353). - net: hns3: Fix for loopback selftest failed problem (bsc#1104353 ). - net: hns3: fix for multiple unmapping DMA problem (bsc#1104353 ). - net: hns3: Fix tc setup when netdev is first up (bsc#1104353 ). - net: hns3: Fix tqp array traversal condition for vf (bsc#1104353 ). - net: hns3: move DMA map into hns3_fill_desc (bsc#1104353 ). - net: hns3: remove hns3_fill_desc_tso (bsc#1104353). - net: hns3: rename hns_nic_dma_unmap (bsc#1104353). - net: hns3: rename the interface for init_client_instance and uninit_client_instance (bsc#1104353). - net: macb: restart tx after tx used bit read (networking-stable-19_01_04). - net/mlx4_en: Change min MTU size to ETH_MIN_MTU (networking-stable-18_12_12). - net/mlx5e: Remove the false indication of software timestamping support (networking-stable-19_01_04). - net/mlx5: Typo fix in del_sw_hw_rule (networking-stable-19_01_04). - net: phy: do not allow __set_phy_supported to add unsupported modes (networking-stable-18_12_12). - net: phy: Fix the issue that netif always links up after resuming (networking-stable-19_01_04). - netrom: fix locking in nr_find_socket() (networking-stable-19_01_04). - net: skb_scrub_packet(): Scrub offload_fwd_mark (networking-stable-18_12_03). - net/smc: fix TCP fallback socket release (networking-stable-19_01_04). - net: stmmac: Fix PCI module removal leak (git-fixes). - net: thunderx: set tso_hdrs pointer to NULL in nicvf_free_snd_queue (networking-stable-18_12_03). - net: thunderx: set xdp_prog to NULL if bpf_prog_add fails (networking-stable-18_12_03). - net/wan: fix a double free in x25_asy_open_tty() (networking-stable-19_01_04). - nfsd: COPY and CLONE operations require the saved filehandle to be set (git-fixes). - nfsd: Fix an Oops in free_session() (git-fixes). - nfs: Fix a missed page unlock after pg_doio() (git-fixes). - NFS: Fix up return value on fatal errors in nfs_page_async_flush() (git-fixes). - NFSv4.1: Fix the r/wsize checking (git-fixes). - NFSv4: Do not exit the state manager without clearing NFS4CLNT_MANAGER_RUNNING (git-fixes). - nvme-multipath: round-robin I/O policy (bsc#1110705). - omap2fb: Fix stack memory disclosure (bsc#1120902) - packet: Do not leak dev refcounts on error exit (git-fixes). - packet: validate address length if non-zero (networking-stable-19_01_04). - packet: validate address length (networking-stable-19_01_04). - PCI: Disable broken RTIT_BAR of Intel TH (bsc#1120318). - phonet: af_phonet: Fix Spectre v1 vulnerability (networking-stable-19_01_04). - platform/x86: asus-nb-wmi: Drop mapping of 0x33 and 0x34 scan codes (bsc#1051510). - platform/x86: asus-nb-wmi: Map 0x35 to KEY_SCREENLOCK (bsc#1051510). - platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey (bsc#1051510). - powerpc: Always save/restore checkpointed regs during treclaim/trecheckpoint (bsc#1118338). - powerpc/cacheinfo: Report the correct shared_cpu_map on big-cores (bsc#1109695). - powerpc: Detect the presence of big-cores via "ibm, thread-groups" (bsc#1109695). - powerpc: make use of for_each_node_by_type() instead of open-coding it (bsc#1109695). - powerpc/powernv: Clear LPCR[PECE1] via stop-api only for deep state offline (bsc#1119766, bsc#1055121). - powerpc/powernv: Clear PECE1 in LPCR via stop-api only on Hotplug (bsc#1119766, bsc#1055121). - powerpc: Remove facility loadups on transactional {fp, vec, vsx} unavailable (bsc#1118338). - powerpc: Remove redundant FP/Altivec giveup code (bsc#1118338). - powerpc/setup: Add cpu_to_phys_id array (bsc#1109695). - powerpc/smp: Add cpu_l2_cache_map (bsc#1109695). - powerpc/smp: Add Power9 scheduler topology (bsc#1109695). - powerpc/smp: Rework CPU topology construction (bsc#1109695). - powerpc/smp: Use cpu_to_chip_id() to find core siblings (bsc#1109695). - powerpc/tm: Avoid machine crash on rt_sigreturn (bsc#1118338). - powerpc/tm: Do not check for WARN in TM Bad Thing handling (bsc#1118338). - powerpc/tm: Fix comment (bsc#1118338). - powerpc/tm: Fix endianness flip on trap (bsc#1118338). - powerpc/tm: Fix HFSCR bit for no suspend case (bsc#1118338). - powerpc/tm: Fix HTM documentation (bsc#1118338). - powerpc/tm: Limit TM code inside PPC_TRANSACTIONAL_MEM (bsc#1118338). - powerpc/tm: P9 disable transactionally suspended sigcontexts (bsc#1118338). - powerpc/tm: Print 64-bits MSR (bsc#1118338). - powerpc/tm: Print scratch value (bsc#1118338). - powerpc/tm: Reformat comments (bsc#1118338). - powerpc/tm: Remove msr_tm_active() (bsc#1118338). - powerpc/tm: Remove struct thread_info param from tm_reclaim_thread() (bsc#1118338). - powerpc/tm: Save MSR to PACA before RFID (bsc#1118338). - powerpc/tm: Set MSR[TS] just prior to recheckpoint (bsc#1118338, bsc#1120955). - powerpc/tm: Unset MSR[TS] if not recheckpointing (bsc#1118338). - powerpc/tm: Update function prototype comment (bsc#1118338). - powerpc: Use cpu_smallcore_sibling_mask at SMT level on bigcores (bsc#1109695). - powerpc/xmon: Fix invocation inside lock region (bsc#1122885). - pstore/ram: Avoid allocation and leak of platform data (bsc#1051510). - pstore/ram: Avoid NULL deref in ftrace merging failure path (bsc#1051510). - pstore/ram: Correctly calculate usable PRZ bytes (bsc#1051510). - pstore/ram: Do not treat empty buffers as valid (bsc#1051510). - ptp_kvm: probe for kvm guest availability (bsc#1098382). - ptr_ring: wrap back ->producer in __ptr_ring_swap_queue() (networking-stable-19_01_04). - qed: Avoid constant logical operation warning in qed_vf_pf_acquire (bsc#1086314 bsc#1086313 bsc#1086301). - qed: Avoid implicit enum conversion in qed_iwarp_parse_rx_pkt (bsc#1086314 bsc#1086313 bsc#1086301 ). - qed: Avoid implicit enum conversion in qed_roce_mode_to_flavor (bsc#1086314 bsc#1086313 bsc#1086301 ). - qed: Avoid implicit enum conversion in qed_set_tunn_cls_info (bsc#1086314 bsc#1086313 bsc#1086301 ). - qed: Fix an error code qed_ll2_start_xmit() (bsc#1086314 bsc#1086313 bsc#1086301). - qed: Fix bitmap_weight() check (bsc#1086314 bsc#1086313 bsc#1086301). - qed: Fix blocking/unlimited SPQ entries leak (bsc#1086314 bsc#1086313 bsc#1086301). - qed: Fix command number mismatch between driver and the mfw (bsc#1086314 bsc#1086313 bsc#1086301 ). - qed: Fix mask parameter in qed_vf_prep_tunn_req_tlv (bsc#1086314 bsc#1086313 bsc#1086301). - qed: Fix memory/entry leak in qed_init_sp_request() (bsc#1086314 bsc#1086313 bsc#1086301). - qed: Fix potential memory corruption (bsc#1086314 bsc#1086313 bsc#1086301). - qed: Fix PTT leak in qed_drain() (bsc#1086314 bsc#1086313 bsc#1086301). - qed: Fix QM getters to always return a valid pq (bsc#1086314 bsc#1086313 bsc#1086301). - qed: Fix rdma_info structure allocation (bsc#1086314 bsc#1086313 bsc#1086301). - qed: Fix reading wrong value in loop condition (bsc#1086314 bsc#1086313 bsc#1086301). - qla2xxx: Fixup dual-protocol FCP connections (bsc#1108870). - qmi_wwan: Added support for Fibocom NL668 series (networking-stable-19_01_04). - qmi_wwan: Added support for Telit LN940 series (networking-stable-19_01_04). - qmi_wwan: Add support for Fibocom NL678 series (networking-stable-19_01_04). - rapidio/rionet: do not free skb before reading its length (networking-stable-18_12_03). - RDMA/core: Fix unwinding flow in case of error to register device (bsc#1046306). - Revert "serial: 8250: Fix clearing FIFOs in RS485 mode again" (bsc#1051510). - rpm/release-projects: Add SUSE:Maintenance:* for MU kernels (bsc#1123317) - rtnetlink: ndo_dflt_fdb_dump() only work for ARPHRD_ETHER devices (networking-stable-18_12_12). - s390/zcrypt: fix specification exception on z196 during ap probe (LTC#174936, bsc#1123061). - sbus: char: add of_node_put() (bsc#1051510). - sched/wait: Fix rcuwait_wake_up() ordering (git-fixes). - scripts/git_sort/git_sort.py: Add mkp/scsi 5.0/scsi-fixes - scripts/git_sort/git_sort.py: Add s390/linux.git fixes. - scsi: qedi: Add ep_state for login completion on un-reachable targets (bsc#1113712). - scsi: qla2xxx: Timeouts occur on surprise removal of QLogic adapter (bsc#1124985). - scsi: target: make the pi_prot_format ConfigFS path readable (bsc#1123933). - sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event (networking-stable-19_01_04). - sctp: kfree_rcu asoc (networking-stable-18_12_12). - selftests/powerpc: Use snprintf to construct DSCR sysfs interface paths (bsc#1124579). - selinux: Add __GFP_NOWARN to allocation at str_read() (bsc#1051510). - selinux: fix GPF on invalid policy (bsc#1051510). - serial: imx: fix error handling in console_setup (bsc#1051510). - serial: set suppress_bind_attrs flag only if builtin (bsc#1051510). - serial/sunsu: fix refcount leak (bsc#1051510). - serial: uartps: Fix interrupt mask issue to handle the RX interrupts properly (bsc#1051510). - shmem: introduce shmem_inode_acct_block (VM Functionality, bsc#1121599). - shmem: shmem_charge: verify max_block is not exceeded before inode update (VM Functionality, bsc#1121599). - signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid namespace init (git-fixes). - slab: alien caches must not be initialized if the allocation of the alien cache failed (git fixes (mm/slab)). - smb3.1.1 dialect is no longer experimental (bsc#1051510). - smb311: Fix reconnect (bsc#1051510). - smb3: Add support for multidialect negotiate (SMB2.1 and later) (bsc#1051510). - smb3: allow stats which track session and share reconnects to be reset (bsc#1051510). - smb3: Backup intent flag missing for directory opens with backupuid mounts (bsc#1051510). - smb3: check for and properly advertise directory lease support (bsc#1051510). - smb3: directory sync should not return an error (bsc#1051510). - smb3: do not attempt cifs operation in smb3 query info error path (bsc#1051510). - smb3: do not request leases in symlink creation and query (bsc#1051510). - smb3: Do not send SMB3 SET_INFO if nothing changed (bsc#1051510). - smb3: enumerating snapshots was leaving part of the data off end (bsc#1051510). - smb3: Fix length checking of SMB3.11 negotiate request (bsc#1051510). - smb3: Fix root directory when server returns inode number of zero (bsc#1051510). - smb3: fix various xid leaks (bsc#1051510). - smb3: Improve security, move default dialect to SMB3 from old CIFS (bsc#1051510). - smb3: on kerberos mount if server does not specify auth type use krb5 (bsc#1051510). - smb3: Remove ifdef since SMB3 (and later) now STRONGLY preferred (bsc#1051510). - smb3: simplify code by removing CONFIG_CIFS_SMB311 (bsc#1051510). - staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1 (bsc#1051510). - sunrpc: correct the computation for page_ptr when truncating (git-fixes). - sunrpc: Fix a potential race in xprt_connect() (git-fixes). - sunrpc: Fix leak of krb5p encode pages (git-fixes). - sunrpc: handle ENOMEM in rpcb_getport_async (git-fixes). - sunrpc: safely reallow resvport min/max inversion (git-fixes). - tcp: Do not underestimate rwnd_limited (networking-stable-18_12_12). - tcp: fix a race in inet_diag_dump_icsk() (networking-stable-19_01_04). - tcp: fix NULL ref in tail loss probe (networking-stable-18_12_12). - tcp: lack of available data can also cause TSO defer (git-fixes). - thermal: int340x_thermal: Fix a NULL vs IS_ERR() check (bsc#1051510). - tipc: compare remote and local protocols in tipc_udp_enable() (networking-stable-19_01_04). - tipc: fix a double kfree_skb() (networking-stable-19_01_04). - tipc: use lock_sock() in tipc_sk_reinit() (networking-stable-19_01_04). - tools/lib/lockdep: Rename "trywlock" into "trywrlock" (bsc#1121973). - tty: Do not hold ldisc lock in tty_reopen() if ldisc present (bsc#1051510). - tty: Handle problem if line discipline does not have receive_buf (bsc#1051510). - tty/n_hdlc: fix __might_sleep warning (bsc#1051510). - tty/serial: do not free trasnmit buffer page under port lock (bsc#1051510). - tun: forbid iface creation with rtnl ops (networking-stable-18_12_12). - uart: Fix crash in uart_write and uart_put_char (bsc#1051510). - usb: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB (bsc#1120902). - usb: cdc-acm: send ZLP for Telit 3G Intel based modems (bsc#1120902). - usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup (bsc#1120902). - usb: dwc3: trace: add missing break statement to make compiler happy (bsc#1120902). - usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2 (networking-stable-18_12_03). - usb: serial: option: add Fibocom NL678 series (bsc#1120902). - usb: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays (bsc#1120902). - usb: storage: add quirk for SMI SM3350 (bsc#1120902). - usb: storage: do not insert sane sense for SPC3+ when bad sense specified (bsc#1120902). - usb: xhci: fix 'broken_suspend' placement in struct xchi_hcd (bsc#1119086). - vfs: Avoid softlockups in drop_pagecache_sb() (bsc#1118505). - vhost: make sure used idx is seen before log in vhost_add_used_n() (networking-stable-19_01_04). - virtio-net: fail XDP set if guest csum is negotiated (networking-stable-18_12_03). - virtio-net: keep vnet header zeroed after processing XDP (networking-stable-18_12_12). - vsock: Send reset control packet when socket is partially bound (networking-stable-19_01_04). - vt: invoke notifier on screen size change (bsc#1051510). - watchdog: w83627hf_wdt: Add quirk for Inves system (bsc#1106434). - writeback: do not decrement wb->refcnt if !wb->bdi (git fixes (writeback)). - x86/bugs: Add AMD's variant of SSB_NO (bsc#1114279). - x86/bugs: Update when to check for the LS_CFG SSBD mitigation (bsc#1114279). - x86/kvmclock: set pvti_cpu0_va after enabling kvmclock (bsc#1098382). - x86/MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out() (bsc#1114279). - x86/microcode/amd: Do not falsely trick the late loading mechanism (bsc#1114279). - x86/mm: Drop usage of __flush_tlb_all() in kernel_physical_mapping_init() (bsc#1114279). - x86, modpost: Replace last remnants of RETPOLINE with CONFIG_RETPOLINE (bsc#1114279). - x86/pvclock: add setter for pvclock_pvti_cpu0_va (bsc#1098382). - x86/resctrl: Fix rdt_find_domain() return value and checks (bsc#1114279). - x86/speculation: Add RETPOLINE_AMD support to the inline asm CALL_NOSPEC variant (bsc#1114279). - x86/speculation: Remove redundant arch_smt_update() invocation (bsc#1114279). - x86/xen/time: Output xen sched_clock time from 0 (bsc#1098382). - x86/xen/time: set pvclock flags on xen_time_init() (bsc#1098382). - x86/xen/time: setup vcpu 0 time info page (bsc#1098382). - xen: Fix x86 sched_clock() interface for xen (bsc#1098382). - xhci: Add quirk to zero 64bit registers on Renesas PCIe controllers (bsc#1120854). - xhci: workaround CSS timeout on AMD SNPS 3.0 xHC (bsc#1119086). - xprtrdma: Reset credit grant properly after a disconnect (git-fixes). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-203=1 Package List: - openSUSE Leap 15.0 (noarch): kernel-devel-4.12.14-lp150.12.48.1 kernel-docs-4.12.14-lp150.12.48.1 kernel-docs-html-4.12.14-lp150.12.48.1 kernel-macros-4.12.14-lp150.12.48.1 kernel-source-4.12.14-lp150.12.48.1 kernel-source-vanilla-4.12.14-lp150.12.48.1 - openSUSE Leap 15.0 (x86_64): kernel-debug-4.12.14-lp150.12.48.1 kernel-debug-base-4.12.14-lp150.12.48.1 kernel-debug-base-debuginfo-4.12.14-lp150.12.48.1 kernel-debug-debuginfo-4.12.14-lp150.12.48.1 kernel-debug-debugsource-4.12.14-lp150.12.48.1 kernel-debug-devel-4.12.14-lp150.12.48.1 kernel-debug-devel-debuginfo-4.12.14-lp150.12.48.1 kernel-default-4.12.14-lp150.12.48.1 kernel-default-base-4.12.14-lp150.12.48.1 kernel-default-base-debuginfo-4.12.14-lp150.12.48.1 kernel-default-debuginfo-4.12.14-lp150.12.48.1 kernel-default-debugsource-4.12.14-lp150.12.48.1 kernel-default-devel-4.12.14-lp150.12.48.1 kernel-default-devel-debuginfo-4.12.14-lp150.12.48.1 kernel-kvmsmall-4.12.14-lp150.12.48.1 kernel-kvmsmall-base-4.12.14-lp150.12.48.1 kernel-kvmsmall-base-debuginfo-4.12.14-lp150.12.48.1 kernel-kvmsmall-debuginfo-4.12.14-lp150.12.48.1 kernel-kvmsmall-debugsource-4.12.14-lp150.12.48.1 kernel-kvmsmall-devel-4.12.14-lp150.12.48.1 kernel-kvmsmall-devel-debuginfo-4.12.14-lp150.12.48.1 kernel-obs-build-4.12.14-lp150.12.48.1 kernel-obs-build-debugsource-4.12.14-lp150.12.48.1 kernel-obs-qa-4.12.14-lp150.12.48.1 kernel-syms-4.12.14-lp150.12.48.1 kernel-vanilla-4.12.14-lp150.12.48.1 kernel-vanilla-base-4.12.14-lp150.12.48.1 kernel-vanilla-base-debuginfo-4.12.14-lp150.12.48.1 kernel-vanilla-debuginfo-4.12.14-lp150.12.48.1 kernel-vanilla-debugsource-4.12.14-lp150.12.48.1 kernel-vanilla-devel-4.12.14-lp150.12.48.1 kernel-vanilla-devel-debuginfo-4.12.14-lp150.12.48.1 References: https://www.suse.com/security/cve/CVE-2018-20669.html https://www.suse.com/security/cve/CVE-2019-3459.html https://www.suse.com/security/cve/CVE-2019-3460.html https://www.suse.com/security/cve/CVE-2019-6974.html https://www.suse.com/security/cve/CVE-2019-7221.html https://www.suse.com/security/cve/CVE-2019-7222.html https://bugzilla.suse.com/1046306 https://bugzilla.suse.com/1050252 https://bugzilla.suse.com/1051510 https://bugzilla.suse.com/1054610 https://bugzilla.suse.com/1055121 https://bugzilla.suse.com/1056658 https://bugzilla.suse.com/1056662 https://bugzilla.suse.com/1084216 https://bugzilla.suse.com/1086301 https://bugzilla.suse.com/1086313 https://bugzilla.suse.com/1086314 https://bugzilla.suse.com/1086323 https://bugzilla.suse.com/1087082 https://bugzilla.suse.com/1087092 https://bugzilla.suse.com/1098382 https://bugzilla.suse.com/1098425 https://bugzilla.suse.com/1104353 https://bugzilla.suse.com/1106105 https://bugzilla.suse.com/1106434 https://bugzilla.suse.com/1106811 https://bugzilla.suse.com/1108870 https://bugzilla.suse.com/1109695 https://bugzilla.suse.com/1110705 https://bugzilla.suse.com/1111666 https://bugzilla.suse.com/1113712 https://bugzilla.suse.com/1113722 https://bugzilla.suse.com/1114279 https://bugzilla.suse.com/1117155 https://bugzilla.suse.com/1118338 https://bugzilla.suse.com/1118505 https://bugzilla.suse.com/1119086 https://bugzilla.suse.com/1119766 https://bugzilla.suse.com/1120318 https://bugzilla.suse.com/1120758 https://bugzilla.suse.com/1120854 https://bugzilla.suse.com/1120902 https://bugzilla.suse.com/1120954 https://bugzilla.suse.com/1120955 https://bugzilla.suse.com/1121599 https://bugzilla.suse.com/1121726 https://bugzilla.suse.com/1121973 https://bugzilla.suse.com/1122019 https://bugzilla.suse.com/1122324 https://bugzilla.suse.com/1122554 https://bugzilla.suse.com/1122662 https://bugzilla.suse.com/1122779 https://bugzilla.suse.com/1122885 https://bugzilla.suse.com/1122927 https://bugzilla.suse.com/1122944 https://bugzilla.suse.com/1122971 https://bugzilla.suse.com/1123061 https://bugzilla.suse.com/1123317 https://bugzilla.suse.com/1123348 https://bugzilla.suse.com/1123357 https://bugzilla.suse.com/1123538 https://bugzilla.suse.com/1123697 https://bugzilla.suse.com/1123933 https://bugzilla.suse.com/1124204 https://bugzilla.suse.com/1124579 https://bugzilla.suse.com/1124589 https://bugzilla.suse.com/1124728 https://bugzilla.suse.com/1124732 https://bugzilla.suse.com/1124735 https://bugzilla.suse.com/1124969 https://bugzilla.suse.com/1124985 https://bugzilla.suse.com/1125109 https://bugzilla.suse.com/802154 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0206-1: important: Security update for chromium
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0206-1 Rating: important References: #1123641 #1124936 Cross-References: CVE-2019-5754 CVE-2019-5755 CVE-2019-5756 CVE-2019-5757 CVE-2019-5758 CVE-2019-5759 CVE-2019-5760 CVE-2019-5761 CVE-2019-5762 CVE-2019-5763 CVE-2019-5764 CVE-2019-5765 CVE-2019-5766 CVE-2019-5767 CVE-2019-5768 CVE-2019-5769 CVE-2019-5770 CVE-2019-5771 CVE-2019-5772 CVE-2019-5773 CVE-2019-5774 CVE-2019-5775 CVE-2019-5776 CVE-2019-5777 CVE-2019-5778 CVE-2019-5779 CVE-2019-5780 CVE-2019-5781 CVE-2019-5782 CVE-2019-5784 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 30 vulnerabilities is now available. Description: This update for Chromium to version 72.0.3626.96 fixes the following issues: Security issues fixed (bsc#1123641 and bsc#1124936): - CVE-2019-5784: Inappropriate implementation in V8 - CVE-2019-5754: Inappropriate implementation in QUIC Networking. - CVE-2019-5782: Inappropriate implementation in V8. - CVE-2019-5755: Inappropriate implementation in V8. - CVE-2019-5756: Use after free in PDFium. - CVE-2019-5757: Type Confusion in SVG. - CVE-2019-5758: Use after free in Blink. - CVE-2019-5759: Use after free in HTML select elements. - CVE-2019-5760: Use after free in WebRTC. - CVE-2019-5761: Use after free in SwiftShader. - CVE-2019-5762: Use after free in PDFium. - CVE-2019-5763: Insufficient validation of untrusted input in V8. - CVE-2019-5764: Use after free in WebRTC. - CVE-2019-5765: Insufficient policy enforcement in the browser. - CVE-2019-5766: Insufficient policy enforcement in Canvas. - CVE-2019-5767: Incorrect security UI in WebAPKs. - CVE-2019-5768: Insufficient policy enforcement in DevTools. - CVE-2019-5769: Insufficient validation of untrusted input in Blink. - CVE-2019-5770: Heap buffer overflow in WebGL. - CVE-2019-5771: Heap buffer overflow in SwiftShader. - CVE-2019-5772: Use after free in PDFium. - CVE-2019-5773: Insufficient data validation in IndexedDB. - CVE-2019-5774: Insufficient validation of untrusted input in SafeBrowsing. - CVE-2019-5775: Insufficient policy enforcement in Omnibox. - CVE-2019-5776: Insufficient policy enforcement in Omnibox. - CVE-2019-5777: Insufficient policy enforcement in Omnibox. - CVE-2019-5778: Insufficient policy enforcement in Extensions. - CVE-2019-5779: Insufficient policy enforcement in ServiceWorker. - CVE-2019-5780: Insufficient policy enforcement. - CVE-2019-5781: Insufficient policy enforcement in Omnibox. For a full list of changes refer to https://chromereleases.googleblog.com/2019/02/stable-channel-update-for-des ktop.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-206=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-72.0.3626.96-88.1 chromedriver-debuginfo-72.0.3626.96-88.1 chromium-72.0.3626.96-88.1 chromium-debuginfo-72.0.3626.96-88.1 chromium-debugsource-72.0.3626.96-88.1 References: https://www.suse.com/security/cve/CVE-2019-5754.html https://www.suse.com/security/cve/CVE-2019-5755.html https://www.suse.com/security/cve/CVE-2019-5756.html https://www.suse.com/security/cve/CVE-2019-5757.html https://www.suse.com/security/cve/CVE-2019-5758.html https://www.suse.com/security/cve/CVE-2019-5759.html https://www.suse.com/security/cve/CVE-2019-5760.html https://www.suse.com/security/cve/CVE-2019-5761.html https://www.suse.com/security/cve/CVE-2019-5762.html https://www.suse.com/security/cve/CVE-2019-5763.html https://www.suse.com/security/cve/CVE-2019-5764.html https://www.suse.com/security/cve/CVE-2019-5765.html https://www.suse.com/security/cve/CVE-2019-5766.html https://www.suse.com/security/cve/CVE-2019-5767.html https://www.suse.com/security/cve/CVE-2019-5768.html https://www.suse.com/security/cve/CVE-2019-5769.html https://www.suse.com/security/cve/CVE-2019-5770.html https://www.suse.com/security/cve/CVE-2019-5771.html https://www.suse.com/security/cve/CVE-2019-5772.html https://www.suse.com/security/cve/CVE-2019-5773.html https://www.suse.com/security/cve/CVE-2019-5774.html https://www.suse.com/security/cve/CVE-2019-5775.html https://www.suse.com/security/cve/CVE-2019-5776.html https://www.suse.com/security/cve/CVE-2019-5777.html https://www.suse.com/security/cve/CVE-2019-5778.html https://www.suse.com/security/cve/CVE-2019-5779.html https://www.suse.com/security/cve/CVE-2019-5780.html https://www.suse.com/security/cve/CVE-2019-5781.html https://www.suse.com/security/cve/CVE-2019-5782.html https://www.suse.com/security/cve/CVE-2019-5784.html https://bugzilla.suse.com/1123641 https://bugzilla.suse.com/1124936 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0200-1: critical: Security update for LibVNCServer
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for LibVNCServer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0200-1 Rating: critical References: #1123823 #1123828 #1123832 Cross-References: CVE-2018-20748 CVE-2018-20749 CVE-2018-20750 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for LibVNCServer fixes the following issues: Security issues fixed: - CVE-2018-20749: Fixed a heap out of bounds write vulnerability in rfbserver.c (bsc#1123828) - CVE-2018-20750: Fixed a heap out of bounds write vulnerability in rfbserver.c (bsc#1123832) - CVE-2018-20748: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1123823) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-200=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): LibVNCServer-debugsource-0.9.9-16.9.1 LibVNCServer-devel-0.9.9-16.9.1 libvncclient0-0.9.9-16.9.1 libvncclient0-debuginfo-0.9.9-16.9.1 libvncserver0-0.9.9-16.9.1 libvncserver0-debuginfo-0.9.9-16.9.1 linuxvnc-0.9.9-16.9.1 linuxvnc-debuginfo-0.9.9-16.9.1 References: https://www.suse.com/security/cve/CVE-2018-20748.html https://www.suse.com/security/cve/CVE-2018-20749.html https://www.suse.com/security/cve/CVE-2018-20750.html https://bugzilla.suse.com/1123823 https://bugzilla.suse.com/1123828 https://bugzilla.suse.com/1123832 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0202-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0202-1 Rating: important References: #1125330 Cross-References: CVE-2018-18335 CVE-2018-18356 CVE-2019-5785 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for MozillaFirefox to version 60.5.1 fixes the following issues: Security issues fixed (bsc#1125330): - CVE-2018-18356: Fixed a use-after-free vulnerability in Skia library. - CVE-2019-5785: Fixed an integer overflow in the Skia library. - CVE-2018-18335: Fixed a buffer overflow in Skia library with accelerated Canvas 2D by disabling Canvas 2D. This vulnerability does not affect Linux platform. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-202=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-60.5.1-131.1 MozillaFirefox-branding-upstream-60.5.1-131.1 MozillaFirefox-buildsymbols-60.5.1-131.1 MozillaFirefox-debuginfo-60.5.1-131.1 MozillaFirefox-debugsource-60.5.1-131.1 MozillaFirefox-devel-60.5.1-131.1 MozillaFirefox-translations-common-60.5.1-131.1 MozillaFirefox-translations-other-60.5.1-131.1 References: https://www.suse.com/security/cve/CVE-2018-18335.html https://www.suse.com/security/cve/CVE-2018-18356.html https://www.suse.com/security/cve/CVE-2019-5785.html https://bugzilla.suse.com/1125330 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0195-1: moderate: Security update for nginx
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for nginx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0195-1 Rating: moderate References: #1115015 #1115022 #1115025 Cross-References: CVE-2018-16843 CVE-2018-16844 CVE-2018-16845 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nginx fixes the following issues: nginx was updated to 1.14.2: - Bugfix: nginx could not be built on Fedora 28 Linux. - Bugfix: in handling of client addresses when using unix domain listen sockets to work with datagrams on Linux. - Change: the logging level of the "http request", "https proxy request", "unsupported protocol", "version too low", "no suitable key share", and "no suitable signature algorithm" SSL errors has been lowered from "crit" to "info". - Bugfix: when using OpenSSL 1.1.0 or newer it was not possible to switch off "ssl_prefer_server_ciphers" in a virtual server if it was switched on in the default server. - Bugfix: nginx could not be built with LibreSSL 2.8.0. - Bugfix: if nginx was built with OpenSSL 1.1.0 and used with OpenSSL 1.1.1, the TLS 1.3 protocol was always enabled. - Bugfix: sending a disk-buffered request body to a gRPC backend might fail. - Bugfix: connections with some gRPC backends might not be cached when using the "keepalive" directive. - Bugfix: a segmentation fault might occur in a worker process if the ngx_http_mp4_module was used on 32-bit platforms. Changes with nginx 1.14.1: - Security: when using HTTP/2 a client might cause excessive memory consumption (CVE-2018-16843) and CPU usage (CVE-2018-16844). - Security: processing of a specially crafted mp4 file with the ngx_http_mp4_module might result in worker process memory disclosure (CVE-2018-16845). - Bugfix: working with gRPC backends might result in excessive memory consumption. Changes with nginx 1.13.12: - Bugfix: connections with gRPC backends might be closed unexpectedly when returning a large response. Changes with nginx 1.13.10 - Feature: the "set" parameter of the "include" SSI directive now allows writing arbitrary responses to a variable; the "subrequest_output_buffer_size" directive defines maximum response size. - Feature: now nginx uses clock_gettime(CLOCK_MONOTONIC) if available, to avoid timeouts being incorrectly triggered on system time changes. - Feature: the "escape=none" parameter of the "log_format" directive. Thanks to Johannes Baiter and Calin Don. - Feature: the $ssl_preread_alpn_protocols variable in the ngx_stream_ssl_preread_module. - Feature: the ngx_http_grpc_module. - Bugfix: in memory allocation error handling in the "geo" directive. - Bugfix: when using variables in the "auth_basic_user_file" directive a null character might appear in logs. Thanks to Vadim Filimonov. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-195=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-195=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-195=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): nginx-1.14.2-2.7.1 nginx-debuginfo-1.14.2-2.7.1 nginx-debugsource-1.14.2-2.7.1 - openSUSE Leap 42.3 (noarch): vim-plugin-nginx-1.14.2-2.7.1 - openSUSE Leap 15.0 (noarch): vim-plugin-nginx-1.14.2-lp150.2.4.1 - openSUSE Leap 15.0 (x86_64): nginx-1.14.2-lp150.2.4.1 nginx-debuginfo-1.14.2-lp150.2.4.1 nginx-debugsource-1.14.2-lp150.2.4.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): nginx-1.14.2-16.1 nginx-debuginfo-1.14.2-16.1 nginx-debugsource-1.14.2-16.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): vim-plugin-nginx-1.14.2-16.1 References: https://www.suse.com/security/cve/CVE-2018-16843.html https://www.suse.com/security/cve/CVE-2018-16844.html https://www.suse.com/security/cve/CVE-2018-16845.html https://bugzilla.suse.com/1115015 https://bugzilla.suse.com/1115022 https://bugzilla.suse.com/1115025 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0194-1: important: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0194-1 Rating: important References: #1123271 #1123272 Cross-References: CVE-2019-6798 CVE-2019-6799 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for phpMyAdmin to version 4.8.5 fixes the following issues: Security issues fixed: - CVE-2019-6799: Fixed an arbitrary file read vulnerability (boo#1123272) - CVE-2019-6798: Fixed a SQL injection in the designer interface (boo#1123271) Other changes: * Fix rxport to SQL format not available * Fix QR code not shown when adding two-factor authentication to a user account * Fix issue with adding a new user in MySQL 8.0.11 and newer * Fix frozen interface relating to Text_Plain_Sql plugin * Fix missing table level operations tab Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-194=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-194=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-194=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-194=1 Package List: - openSUSE Leap 42.3 (noarch): phpMyAdmin-4.8.5-27.1 - openSUSE Leap 15.0 (noarch): phpMyAdmin-4.8.5-lp150.2.15.1 - openSUSE Backports SLE-15 (noarch): phpMyAdmin-4.8.5-bp150.3.9.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.8.5-35.1 References: https://www.suse.com/security/cve/CVE-2019-6798.html https://www.suse.com/security/cve/CVE-2019-6799.html https://bugzilla.suse.com/1123271 https://bugzilla.suse.com/1123272 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0195-1: moderate: Security update for nginx
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for nginx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0195-1 Rating: moderate References: #1115015 #1115022 #1115025 Cross-References: CVE-2018-16843 CVE-2018-16844 CVE-2018-16845 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nginx fixes the following issues: nginx was updated to 1.14.2: - Bugfix: nginx could not be built on Fedora 28 Linux. - Bugfix: in handling of client addresses when using unix domain listen sockets to work with datagrams on Linux. - Change: the logging level of the "http request", "https proxy request", "unsupported protocol", "version too low", "no suitable key share", and "no suitable signature algorithm" SSL errors has been lowered from "crit" to "info". - Bugfix: when using OpenSSL 1.1.0 or newer it was not possible to switch off "ssl_prefer_server_ciphers" in a virtual server if it was switched on in the default server. - Bugfix: nginx could not be built with LibreSSL 2.8.0. - Bugfix: if nginx was built with OpenSSL 1.1.0 and used with OpenSSL 1.1.1, the TLS 1.3 protocol was always enabled. - Bugfix: sending a disk-buffered request body to a gRPC backend might fail. - Bugfix: connections with some gRPC backends might not be cached when using the "keepalive" directive. - Bugfix: a segmentation fault might occur in a worker process if the ngx_http_mp4_module was used on 32-bit platforms. Changes with nginx 1.14.1: - Security: when using HTTP/2 a client might cause excessive memory consumption (CVE-2018-16843) and CPU usage (CVE-2018-16844). - Security: processing of a specially crafted mp4 file with the ngx_http_mp4_module might result in worker process memory disclosure (CVE-2018-16845). - Bugfix: working with gRPC backends might result in excessive memory consumption. Changes with nginx 1.13.12: - Bugfix: connections with gRPC backends might be closed unexpectedly when returning a large response. Changes with nginx 1.13.10 - Feature: the "set" parameter of the "include" SSI directive now allows writing arbitrary responses to a variable; the "subrequest_output_buffer_size" directive defines maximum response size. - Feature: now nginx uses clock_gettime(CLOCK_MONOTONIC) if available, to avoid timeouts being incorrectly triggered on system time changes. - Feature: the "escape=none" parameter of the "log_format" directive. Thanks to Johannes Baiter and Calin Don. - Feature: the $ssl_preread_alpn_protocols variable in the ngx_stream_ssl_preread_module. - Feature: the ngx_http_grpc_module. - Bugfix: in memory allocation error handling in the "geo" directive. - Bugfix: when using variables in the "auth_basic_user_file" directive a null character might appear in logs. Thanks to Vadim Filimonov. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-195=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-195=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): nginx-1.14.2-2.7.1 nginx-debuginfo-1.14.2-2.7.1 nginx-debugsource-1.14.2-2.7.1 - openSUSE Leap 42.3 (noarch): vim-plugin-nginx-1.14.2-2.7.1 - openSUSE Leap 15.0 (x86_64): nginx-1.14.2-lp150.2.4.1 nginx-debuginfo-1.14.2-lp150.2.4.1 nginx-debugsource-1.14.2-lp150.2.4.1 - openSUSE Leap 15.0 (noarch): vim-plugin-nginx-1.14.2-lp150.2.4.1 References: https://www.suse.com/security/cve/CVE-2018-16843.html https://www.suse.com/security/cve/CVE-2018-16844.html https://www.suse.com/security/cve/CVE-2018-16845.html https://bugzilla.suse.com/1115015 https://bugzilla.suse.com/1115022 https://bugzilla.suse.com/1115025 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0199-1: Security update for libu2f-host
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for libu2f-host ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0199-1 Rating: low References: #1124781 Cross-References: CVE-2018-20340 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libu2f-host fixes the following issues: Security issue fixed: - CVE-2018-20340: Fixed an unchecked buffer, which could allow a buffer overflow with a custom made malicious USB device (bsc#1124781). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-199=1 Package List: - openSUSE Leap 42.3 (x86_64): libu2f-host-debugsource-1.0.0-5.3.1 libu2f-host-devel-1.0.0-5.3.1 libu2f-host-doc-1.0.0-5.3.1 libu2f-host0-1.0.0-5.3.1 libu2f-host0-debuginfo-1.0.0-5.3.1 u2f-host-1.0.0-5.3.1 u2f-host-debuginfo-1.0.0-5.3.1 References: https://www.suse.com/security/cve/CVE-2018-20340.html https://bugzilla.suse.com/1124781 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0197-1: moderate: Security update for avahi
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for avahi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0197-1 Rating: moderate References: #1120281 Cross-References: CVE-2018-1000845 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for avahi fixes the following issues: Security issue fixed: - CVE-2018-1000845: Fixed DNS amplification and reflection to spoofed addresses (DOS) (bsc#1120281) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-197=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): avahi-0.6.32-lp150.4.3.1 avahi-autoipd-0.6.32-lp150.4.3.1 avahi-autoipd-debuginfo-0.6.32-lp150.4.3.1 avahi-compat-howl-devel-0.6.32-lp150.4.3.1 avahi-compat-mDNSResponder-devel-0.6.32-lp150.4.3.1 avahi-debuginfo-0.6.32-lp150.4.3.1 avahi-debugsource-0.6.32-lp150.4.3.1 avahi-glib2-debugsource-0.6.32-lp150.4.3.1 avahi-utils-0.6.32-lp150.4.3.1 avahi-utils-debuginfo-0.6.32-lp150.4.3.1 avahi-utils-gtk-0.6.32-lp150.4.3.1 avahi-utils-gtk-debuginfo-0.6.32-lp150.4.3.1 libavahi-client3-0.6.32-lp150.4.3.1 libavahi-client3-debuginfo-0.6.32-lp150.4.3.1 libavahi-common3-0.6.32-lp150.4.3.1 libavahi-common3-debuginfo-0.6.32-lp150.4.3.1 libavahi-core7-0.6.32-lp150.4.3.1 libavahi-core7-debuginfo-0.6.32-lp150.4.3.1 libavahi-devel-0.6.32-lp150.4.3.1 libavahi-glib-devel-0.6.32-lp150.4.3.1 libavahi-glib1-0.6.32-lp150.4.3.1 libavahi-glib1-debuginfo-0.6.32-lp150.4.3.1 libavahi-gobject-devel-0.6.32-lp150.4.3.1 libavahi-gobject0-0.6.32-lp150.4.3.1 libavahi-gobject0-debuginfo-0.6.32-lp150.4.3.1 libavahi-ui-gtk3-0-0.6.32-lp150.4.3.1 libavahi-ui-gtk3-0-debuginfo-0.6.32-lp150.4.3.1 libavahi-ui0-0.6.32-lp150.4.3.1 libavahi-ui0-debuginfo-0.6.32-lp150.4.3.1 libdns_sd-0.6.32-lp150.4.3.1 libdns_sd-debuginfo-0.6.32-lp150.4.3.1 libhowl0-0.6.32-lp150.4.3.1 libhowl0-debuginfo-0.6.32-lp150.4.3.1 python-avahi-0.6.32-lp150.4.3.1 python-avahi-gtk-0.6.32-lp150.4.3.1 typelib-1_0-Avahi-0_6-0.6.32-lp150.4.3.1 - openSUSE Leap 15.0 (noarch): avahi-lang-0.6.32-lp150.4.3.1 - openSUSE Leap 15.0 (x86_64): avahi-32bit-debuginfo-0.6.32-lp150.4.3.1 avahi-mono-0.6.32-lp150.4.3.1 avahi-qt4-debugsource-0.6.32-lp150.4.3.1 libavahi-client3-32bit-0.6.32-lp150.4.3.1 libavahi-client3-32bit-debuginfo-0.6.32-lp150.4.3.1 libavahi-common3-32bit-0.6.32-lp150.4.3.1 libavahi-common3-32bit-debuginfo-0.6.32-lp150.4.3.1 libavahi-glib1-32bit-0.6.32-lp150.4.3.1 libavahi-glib1-32bit-debuginfo-0.6.32-lp150.4.3.1 libavahi-qt4-1-0.6.32-lp150.4.3.1 libavahi-qt4-1-debuginfo-0.6.32-lp150.4.3.1 libavahi-qt4-devel-0.6.32-lp150.4.3.1 libdns_sd-32bit-0.6.32-lp150.4.3.1 libdns_sd-32bit-debuginfo-0.6.32-lp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000845.html https://bugzilla.suse.com/1120281 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0196-1: critical: Security update for LibVNCServer
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for LibVNCServer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0196-1 Rating: critical References: #1123823 #1123828 #1123832 Cross-References: CVE-2018-20748 CVE-2018-20749 CVE-2018-20750 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for LibVNCServer fixes the following issues: Security issues fixed: - CVE-2018-20749: Fixed a heap out of bounds write vulnerability in rfbserver.c (bsc#1123828) - CVE-2018-20750: Fixed a heap out of bounds write vulnerability in rfbserver.c (bsc#1123832) - CVE-2018-20748: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1123823) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-196=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): LibVNCServer-debugsource-0.9.10-lp150.3.6.1 LibVNCServer-devel-0.9.10-lp150.3.6.1 libvncclient0-0.9.10-lp150.3.6.1 libvncclient0-debuginfo-0.9.10-lp150.3.6.1 libvncserver0-0.9.10-lp150.3.6.1 libvncserver0-debuginfo-0.9.10-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-20748.html https://www.suse.com/security/cve/CVE-2018-20749.html https://www.suse.com/security/cve/CVE-2018-20750.html https://bugzilla.suse.com/1123823 https://bugzilla.suse.com/1123828 https://bugzilla.suse.com/1123832 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0198-1: moderate: Security update for pspp, spread-sheet-widget
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for pspp, spread-sheet-widget ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0198-1 Rating: moderate References: #1120061 Cross-References: CVE-2018-20230 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pspp to version 1.2.0 fixes the following issues: Security issue fixed: - CVE-2018-20230: Fixed a heap-based buffer overflow in read_bytes_internal function that could lead to denial-of-service (bsc#1120061). Other bug fixes and changes: - Add upstream patch to avoid compiling with old Texinfo 4.13. - New experimental command SAVE DATA COLLECTION to save MDD files. - MTIME and YMDHMS variable formats now supported. - Spread sheet rendering now done via spread-sheet-widget. This update introduces a new package called spread-sheet-widget as dependency. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-198=1 Package List: - openSUSE Leap 15.0 (x86_64): libspread-sheet-widget0-0.3-lp150.2.1 libspread-sheet-widget0-debuginfo-0.3-lp150.2.1 pspp-1.2.0-lp150.2.3.1 pspp-debuginfo-1.2.0-lp150.2.3.1 pspp-debugsource-1.2.0-lp150.2.3.1 pspp-devel-1.2.0-lp150.2.3.1 spread-sheet-widget-debugsource-0.3-lp150.2.1 spread-sheet-widget-devel-0.3-lp150.2.1 References: https://www.suse.com/security/cve/CVE-2018-20230.html https://bugzilla.suse.com/1120061 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0194-1: important: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0194-1 Rating: important References: #1123271 #1123272 Cross-References: CVE-2019-6798 CVE-2019-6799 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for phpMyAdmin to version 4.8.5 fixes the following issues: Security issues fixed: - CVE-2019-6799: Fixed an arbitrary file read vulnerability (boo#1123272) - CVE-2019-6798: Fixed a SQL injection in the designer interface (boo#1123271) Other changes: * Fix rxport to SQL format not available * Fix QR code not shown when adding two-factor authentication to a user account * Fix issue with adding a new user in MySQL 8.0.11 and newer * Fix frozen interface relating to Text_Plain_Sql plugin * Fix missing table level operations tab Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-194=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.8.5-35.1 References: https://www.suse.com/security/cve/CVE-2019-6798.html https://www.suse.com/security/cve/CVE-2019-6799.html https://bugzilla.suse.com/1123271 https://bugzilla.suse.com/1123272 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0189-1: moderate: Security update for docker
by opensuse-security＠opensuse.org 16 Feb '19

16 Feb '19

openSUSE Security Update: Security update for docker ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0189-1 Rating: moderate References: #1001161 #1112980 #1115464 #1118897 #1118898 #1118899 #1118990 #1121412 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has 5 fixes is now available. Description: This update for containerd, docker, docker-runc and golang-github-docker-libnetwork fixes the following issues: Security issues fixed for containerd, docker, docker-runc and golang-github-docker-libnetwork: - CVE-2018-16873: cmd/go: remote command execution during "go get -u" (bsc#1118897) - CVE-2018-16874: cmd/go: directory traversal in "go get" via curly braces in import paths (bsc#1118898) - CVE-2018-16875: crypto/x509: CPU denial of service (bsc#1118899) Non-security issues fixed for docker: - Disable leap based builds for kubic flavor (bsc#1121412) - Allow users to explicitly specify the NIS domainname of a container (bsc#1001161) - Update docker.service to match upstream and avoid rlimit problems (bsc#1112980) - Allow docker images larger then 23GB (bsc#1118990) - Docker version update to version 18.09.0-ce (bsc#1115464) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-189=1 Package List: - openSUSE Leap 15.0 (noarch): containerd-test-1.1.2-lp150.4.6.1 docker-bash-completion-18.09.0_ce-lp150.5.9.1 docker-runc-test-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.6.1 docker-zsh-completion-18.09.0_ce-lp150.5.9.1 - openSUSE Leap 15.0 (x86_64): containerd-1.1.2-lp150.4.6.1 containerd-ctr-1.1.2-lp150.4.6.1 docker-18.09.0_ce-lp150.5.9.1 docker-debuginfo-18.09.0_ce-lp150.5.9.1 docker-debugsource-18.09.0_ce-lp150.5.9.1 docker-libnetwork-0.7.0.1+gitr2704_6da50d197830-lp150.3.6.1 docker-libnetwork-debuginfo-0.7.0.1+gitr2704_6da50d197830-lp150.3.6.1 docker-runc-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.6.1 docker-runc-debuginfo-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.6.1 docker-test-18.09.0_ce-lp150.5.9.1 docker-test-debuginfo-18.09.0_ce-lp150.5.9.1 golang-github-docker-libnetwork-0.7.0.1+gitr2704_6da50d197830-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://bugzilla.suse.com/1001161 https://bugzilla.suse.com/1112980 https://bugzilla.suse.com/1115464 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899 https://bugzilla.suse.com/1118990 https://bugzilla.suse.com/1121412 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0182-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0182-1 Rating: important References: #1122983 Cross-References: CVE-2016-5824 CVE-2018-12405 CVE-2018-17466 CVE-2018-18492 CVE-2018-18493 CVE-2018-18494 CVE-2018-18498 CVE-2018-18500 CVE-2018-18501 CVE-2018-18505 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 60.5.0 fixes the following issues: Security vulnerabilities addressed (MFSA 2019-03 boo#1122983 MFSA 2018-31): - CVE-2018-18500: Use-after-free parsing HTML5 stream - CVE-2018-18505: Privilege escalation through IPC channel messages - CVE-2016-5824: DoS (use-after-free) via a crafted ics file - CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 - CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11 - CVE-2018-18492: Use-after-free with select element - CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia - CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs - CVE-2018-18498: Integer overflow when calculating buffer sizes for images - CVE-2018-12405: Memory safety bugs fixed in Firefox 64, 60.4, and Thunderbird 60.4 Other bugs fixed and changes made: - FileLink provider WeTransfer to upload large attachments - Thunderbird now allows the addition of OpenSearch search engines from a local XML file using a minimal user inferface: [+] button to select a file an add, [-] to remove. - More search engines: Google and DuckDuckGo available by default in some locales - During account creation, Thunderbird will now detect servers using the Microsoft Exchange protocol. It will offer the installation of a 3rd party add-on (Owl) which supports that protocol. - Thunderbird now compatible with other WebExtension-based FileLink add-ons like the Dropbox add-on - New WebExtensions FileLink API to facilitate add-ons - Fix decoding problems for messages with less common charsets (cp932, cp936) - New messages in the drafts folder (and other special or virtual folders) will no longer be included in the new messages notification - Thunderbird 60 will migrate security databases (key3.db, cert8.db to key4.db, cert9.db). Thunderbird 60.3.2 and earlier contained a fault that potentially deleted saved passwords and private certificate keys for users using a master password. Version 60.3.3 will prevent the loss of data; affected users who have already upgraded to version 60.3.2 or earlier can restore the deleted key3.db file from backup to complete the migration. - Address book search and auto-complete slowness introduced in Thunderbird 60.3.2 - Plain text markup with * for bold, / for italics, _ for underline and | for code did not work when the enclosed text contained non-ASCII characters - While composing a message, a link not removed when link location was removed in the link properties panel - Encoding problems when exporting address books or messages using the system charset. Messages are now always exported using the UTF-8 encoding - If the "Date" header of a message was invalid, Jan 1970 or Dec 1969 was displayed. Now using date from "Received" header instead. - Body search/filtering didn't reliably ignore content of tags - Inappropriate warning "Thunderbird prevented the site (addons.thunderbird.net) from asking you to install software on your computer" when installing add-ons - Incorrect display of correspondents column since own email address was not always detected - Spurious 
 (encoded newline) inserted into drafts and sent email - Double-clicking on a word in the Write window sometimes launched the Advanced Property Editor or Link Properties dialog - Fixe Cookie removal - "Download rest of message" was not working if global inbox was used - Fix Encoding problems for users (especially in Poland) when a file was sent via a folder using "Sent to > Mail recipient" due to a problem in the Thunderbird MAPI interface - According to RFC 4616 and RFC 5721, passwords containing non-ASCII characters are encoded using UTF-8 which can lead to problems with non-compliant providers, for example office365.com. The SMTP LOGIN and POP3 USER/PASS authentication methods are now using a Latin-1 encoding again to work around this issue - Fix shutdown crash/hang after entering an empty IMAP password Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-182=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaThunderbird-60.5.0-83.1 MozillaThunderbird-buildsymbols-60.5.0-83.1 MozillaThunderbird-debuginfo-60.5.0-83.1 MozillaThunderbird-debugsource-60.5.0-83.1 MozillaThunderbird-translations-common-60.5.0-83.1 MozillaThunderbird-translations-other-60.5.0-83.1 References: https://www.suse.com/security/cve/CVE-2016-5824.html https://www.suse.com/security/cve/CVE-2018-12405.html https://www.suse.com/security/cve/CVE-2018-17466.html https://www.suse.com/security/cve/CVE-2018-18492.html https://www.suse.com/security/cve/CVE-2018-18493.html https://www.suse.com/security/cve/CVE-2018-18494.html https://www.suse.com/security/cve/CVE-2018-18498.html https://www.suse.com/security/cve/CVE-2018-18500.html https://www.suse.com/security/cve/CVE-2018-18501.html https://www.suse.com/security/cve/CVE-2018-18505.html https://bugzilla.suse.com/1122983 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0183-1: important: Security update for mozilla-nss
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0183-1 Rating: important References: #1119069 Cross-References: CVE-2018-12404 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mozilla-nss fixes the following issues: Security issues fixed: - CVE-2018-12404: Cache side-channel variant of the Bleichenbacher attack (bsc#1119069). Non-security issue fixed: - Update to mozilla-nss 3.41.1 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-183=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libfreebl3-3.41.1-lp150.2.16.1 libfreebl3-debuginfo-3.41.1-lp150.2.16.1 libfreebl3-hmac-3.41.1-lp150.2.16.1 libsoftokn3-3.41.1-lp150.2.16.1 libsoftokn3-debuginfo-3.41.1-lp150.2.16.1 libsoftokn3-hmac-3.41.1-lp150.2.16.1 mozilla-nss-3.41.1-lp150.2.16.1 mozilla-nss-certs-3.41.1-lp150.2.16.1 mozilla-nss-certs-debuginfo-3.41.1-lp150.2.16.1 mozilla-nss-debuginfo-3.41.1-lp150.2.16.1 mozilla-nss-debugsource-3.41.1-lp150.2.16.1 mozilla-nss-devel-3.41.1-lp150.2.16.1 mozilla-nss-sysinit-3.41.1-lp150.2.16.1 mozilla-nss-sysinit-debuginfo-3.41.1-lp150.2.16.1 mozilla-nss-tools-3.41.1-lp150.2.16.1 mozilla-nss-tools-debuginfo-3.41.1-lp150.2.16.1 - openSUSE Leap 15.0 (x86_64): libfreebl3-32bit-3.41.1-lp150.2.16.1 libfreebl3-32bit-debuginfo-3.41.1-lp150.2.16.1 libfreebl3-hmac-32bit-3.41.1-lp150.2.16.1 libsoftokn3-32bit-3.41.1-lp150.2.16.1 libsoftokn3-32bit-debuginfo-3.41.1-lp150.2.16.1 libsoftokn3-hmac-32bit-3.41.1-lp150.2.16.1 mozilla-nss-32bit-3.41.1-lp150.2.16.1 mozilla-nss-32bit-debuginfo-3.41.1-lp150.2.16.1 mozilla-nss-certs-32bit-3.41.1-lp150.2.16.1 mozilla-nss-certs-32bit-debuginfo-3.41.1-lp150.2.16.1 mozilla-nss-sysinit-32bit-3.41.1-lp150.2.16.1 mozilla-nss-sysinit-32bit-debuginfo-3.41.1-lp150.2.16.1 References: https://www.suse.com/security/cve/CVE-2018-12404.html https://bugzilla.suse.com/1119069 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0184-1: moderate: Security update for python
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0184-1 Rating: moderate References: #1122191 Cross-References: CVE-2019-5010 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python fixes the following issues: Security issue fixed: - CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-184=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libpython2_7-1_0-2.7.14-lp150.6.6.1 libpython2_7-1_0-debuginfo-2.7.14-lp150.6.6.1 python-2.7.14-lp150.6.6.1 python-base-2.7.14-lp150.6.6.1 python-base-debuginfo-2.7.14-lp150.6.6.1 python-base-debugsource-2.7.14-lp150.6.6.1 python-curses-2.7.14-lp150.6.6.1 python-curses-debuginfo-2.7.14-lp150.6.6.1 python-debuginfo-2.7.14-lp150.6.6.1 python-debugsource-2.7.14-lp150.6.6.1 python-demo-2.7.14-lp150.6.6.1 python-devel-2.7.14-lp150.6.6.1 python-gdbm-2.7.14-lp150.6.6.1 python-gdbm-debuginfo-2.7.14-lp150.6.6.1 python-idle-2.7.14-lp150.6.6.1 python-tk-2.7.14-lp150.6.6.1 python-tk-debuginfo-2.7.14-lp150.6.6.1 python-xml-2.7.14-lp150.6.6.1 python-xml-debuginfo-2.7.14-lp150.6.6.1 - openSUSE Leap 15.0 (x86_64): libpython2_7-1_0-32bit-2.7.14-lp150.6.6.1 libpython2_7-1_0-32bit-debuginfo-2.7.14-lp150.6.6.1 python-32bit-2.7.14-lp150.6.6.1 python-32bit-debuginfo-2.7.14-lp150.6.6.1 python-base-32bit-2.7.14-lp150.6.6.1 python-base-32bit-debuginfo-2.7.14-lp150.6.6.1 - openSUSE Leap 15.0 (noarch): python-doc-2.7.14-lp150.6.6.1 python-doc-pdf-2.7.14-lp150.6.6.1 References: https://www.suse.com/security/cve/CVE-2019-5010.html https://bugzilla.suse.com/1122191 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0185-1: moderate: Security update for rmt-server
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for rmt-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0185-1 Rating: moderate References: #1102046 #1102193 #1109307 #1113760 #1113969 #1114831 #1117106 #1118579 #1118584 Cross-References: CVE-2018-14404 CVE-2018-16468 CVE-2018-16470 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has 6 fixes is now available. Description: This update for rmt-server to version 1.1.1 fixes the following issues: The following issues have been fixed: - Fixed migration problems which caused some extensions / modules to be dropped (bsc#1118584, bsc#1118579) - Fixed listing of mirrored products (bsc#1102193) - Include online migration paths into offline migration (bsc#1117106) - Sync products that do not have a base product (bsc#1109307) - Fixed SLP auto discovery for RMT (bsc#1113760) Update dependencies for security fixes: - CVE-2018-16468: Update loofah to 2.2.3 (bsc#1113969) - CVE-2018-16470: Update rack to 2.0.6 (bsc#1114831) - CVE-2018-14404: Update nokogiri to 1.8.5 (bsc#1102046) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-185=1 Package List: - openSUSE Leap 15.0 (x86_64): rmt-server-1.1.1-lp150.2.12.1 rmt-server-debuginfo-1.1.1-lp150.2.12.1 rmt-server-pubcloud-1.1.1-lp150.2.12.1 References: https://www.suse.com/security/cve/CVE-2018-14404.html https://www.suse.com/security/cve/CVE-2018-16468.html https://www.suse.com/security/cve/CVE-2018-16470.html https://bugzilla.suse.com/1102046 https://bugzilla.suse.com/1102193 https://bugzilla.suse.com/1109307 https://bugzilla.suse.com/1113760 https://bugzilla.suse.com/1113969 https://bugzilla.suse.com/1114831 https://bugzilla.suse.com/1117106 https://bugzilla.suse.com/1118579 https://bugzilla.suse.com/1118584 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0