February 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:0199-1: Security update for libu2f-host
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for libu2f-host ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0199-1 Rating: low References: #1124781 Cross-References: CVE-2018-20340 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libu2f-host fixes the following issues: Security issue fixed: - CVE-2018-20340: Fixed an unchecked buffer, which could allow a buffer overflow with a custom made malicious USB device (bsc#1124781). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-199=1 Package List: - openSUSE Leap 42.3 (x86_64): libu2f-host-debugsource-1.0.0-5.3.1 libu2f-host-devel-1.0.0-5.3.1 libu2f-host-doc-1.0.0-5.3.1 libu2f-host0-1.0.0-5.3.1 libu2f-host0-debuginfo-1.0.0-5.3.1 u2f-host-1.0.0-5.3.1 u2f-host-debuginfo-1.0.0-5.3.1 References: https://www.suse.com/security/cve/CVE-2018-20340.html https://bugzilla.suse.com/1124781 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0197-1: moderate: Security update for avahi
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for avahi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0197-1 Rating: moderate References: #1120281 Cross-References: CVE-2018-1000845 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for avahi fixes the following issues: Security issue fixed: - CVE-2018-1000845: Fixed DNS amplification and reflection to spoofed addresses (DOS) (bsc#1120281) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-197=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): avahi-0.6.32-lp150.4.3.1 avahi-autoipd-0.6.32-lp150.4.3.1 avahi-autoipd-debuginfo-0.6.32-lp150.4.3.1 avahi-compat-howl-devel-0.6.32-lp150.4.3.1 avahi-compat-mDNSResponder-devel-0.6.32-lp150.4.3.1 avahi-debuginfo-0.6.32-lp150.4.3.1 avahi-debugsource-0.6.32-lp150.4.3.1 avahi-glib2-debugsource-0.6.32-lp150.4.3.1 avahi-utils-0.6.32-lp150.4.3.1 avahi-utils-debuginfo-0.6.32-lp150.4.3.1 avahi-utils-gtk-0.6.32-lp150.4.3.1 avahi-utils-gtk-debuginfo-0.6.32-lp150.4.3.1 libavahi-client3-0.6.32-lp150.4.3.1 libavahi-client3-debuginfo-0.6.32-lp150.4.3.1 libavahi-common3-0.6.32-lp150.4.3.1 libavahi-common3-debuginfo-0.6.32-lp150.4.3.1 libavahi-core7-0.6.32-lp150.4.3.1 libavahi-core7-debuginfo-0.6.32-lp150.4.3.1 libavahi-devel-0.6.32-lp150.4.3.1 libavahi-glib-devel-0.6.32-lp150.4.3.1 libavahi-glib1-0.6.32-lp150.4.3.1 libavahi-glib1-debuginfo-0.6.32-lp150.4.3.1 libavahi-gobject-devel-0.6.32-lp150.4.3.1 libavahi-gobject0-0.6.32-lp150.4.3.1 libavahi-gobject0-debuginfo-0.6.32-lp150.4.3.1 libavahi-ui-gtk3-0-0.6.32-lp150.4.3.1 libavahi-ui-gtk3-0-debuginfo-0.6.32-lp150.4.3.1 libavahi-ui0-0.6.32-lp150.4.3.1 libavahi-ui0-debuginfo-0.6.32-lp150.4.3.1 libdns_sd-0.6.32-lp150.4.3.1 libdns_sd-debuginfo-0.6.32-lp150.4.3.1 libhowl0-0.6.32-lp150.4.3.1 libhowl0-debuginfo-0.6.32-lp150.4.3.1 python-avahi-0.6.32-lp150.4.3.1 python-avahi-gtk-0.6.32-lp150.4.3.1 typelib-1_0-Avahi-0_6-0.6.32-lp150.4.3.1 - openSUSE Leap 15.0 (noarch): avahi-lang-0.6.32-lp150.4.3.1 - openSUSE Leap 15.0 (x86_64): avahi-32bit-debuginfo-0.6.32-lp150.4.3.1 avahi-mono-0.6.32-lp150.4.3.1 avahi-qt4-debugsource-0.6.32-lp150.4.3.1 libavahi-client3-32bit-0.6.32-lp150.4.3.1 libavahi-client3-32bit-debuginfo-0.6.32-lp150.4.3.1 libavahi-common3-32bit-0.6.32-lp150.4.3.1 libavahi-common3-32bit-debuginfo-0.6.32-lp150.4.3.1 libavahi-glib1-32bit-0.6.32-lp150.4.3.1 libavahi-glib1-32bit-debuginfo-0.6.32-lp150.4.3.1 libavahi-qt4-1-0.6.32-lp150.4.3.1 libavahi-qt4-1-debuginfo-0.6.32-lp150.4.3.1 libavahi-qt4-devel-0.6.32-lp150.4.3.1 libdns_sd-32bit-0.6.32-lp150.4.3.1 libdns_sd-32bit-debuginfo-0.6.32-lp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000845.html https://bugzilla.suse.com/1120281 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0196-1: critical: Security update for LibVNCServer
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for LibVNCServer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0196-1 Rating: critical References: #1123823 #1123828 #1123832 Cross-References: CVE-2018-20748 CVE-2018-20749 CVE-2018-20750 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for LibVNCServer fixes the following issues: Security issues fixed: - CVE-2018-20749: Fixed a heap out of bounds write vulnerability in rfbserver.c (bsc#1123828) - CVE-2018-20750: Fixed a heap out of bounds write vulnerability in rfbserver.c (bsc#1123832) - CVE-2018-20748: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1123823) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-196=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): LibVNCServer-debugsource-0.9.10-lp150.3.6.1 LibVNCServer-devel-0.9.10-lp150.3.6.1 libvncclient0-0.9.10-lp150.3.6.1 libvncclient0-debuginfo-0.9.10-lp150.3.6.1 libvncserver0-0.9.10-lp150.3.6.1 libvncserver0-debuginfo-0.9.10-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-20748.html https://www.suse.com/security/cve/CVE-2018-20749.html https://www.suse.com/security/cve/CVE-2018-20750.html https://bugzilla.suse.com/1123823 https://bugzilla.suse.com/1123828 https://bugzilla.suse.com/1123832 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0198-1: moderate: Security update for pspp, spread-sheet-widget
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for pspp, spread-sheet-widget ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0198-1 Rating: moderate References: #1120061 Cross-References: CVE-2018-20230 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pspp to version 1.2.0 fixes the following issues: Security issue fixed: - CVE-2018-20230: Fixed a heap-based buffer overflow in read_bytes_internal function that could lead to denial-of-service (bsc#1120061). Other bug fixes and changes: - Add upstream patch to avoid compiling with old Texinfo 4.13. - New experimental command SAVE DATA COLLECTION to save MDD files. - MTIME and YMDHMS variable formats now supported. - Spread sheet rendering now done via spread-sheet-widget. This update introduces a new package called spread-sheet-widget as dependency. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-198=1 Package List: - openSUSE Leap 15.0 (x86_64): libspread-sheet-widget0-0.3-lp150.2.1 libspread-sheet-widget0-debuginfo-0.3-lp150.2.1 pspp-1.2.0-lp150.2.3.1 pspp-debuginfo-1.2.0-lp150.2.3.1 pspp-debugsource-1.2.0-lp150.2.3.1 pspp-devel-1.2.0-lp150.2.3.1 spread-sheet-widget-debugsource-0.3-lp150.2.1 spread-sheet-widget-devel-0.3-lp150.2.1 References: https://www.suse.com/security/cve/CVE-2018-20230.html https://bugzilla.suse.com/1120061 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0194-1: important: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 18 Feb '19

18 Feb '19

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0194-1 Rating: important References: #1123271 #1123272 Cross-References: CVE-2019-6798 CVE-2019-6799 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for phpMyAdmin to version 4.8.5 fixes the following issues: Security issues fixed: - CVE-2019-6799: Fixed an arbitrary file read vulnerability (boo#1123272) - CVE-2019-6798: Fixed a SQL injection in the designer interface (boo#1123271) Other changes: * Fix rxport to SQL format not available * Fix QR code not shown when adding two-factor authentication to a user account * Fix issue with adding a new user in MySQL 8.0.11 and newer * Fix frozen interface relating to Text_Plain_Sql plugin * Fix missing table level operations tab Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-194=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.8.5-35.1 References: https://www.suse.com/security/cve/CVE-2019-6798.html https://www.suse.com/security/cve/CVE-2019-6799.html https://bugzilla.suse.com/1123271 https://bugzilla.suse.com/1123272 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0189-1: moderate: Security update for docker
by opensuse-security＠opensuse.org 16 Feb '19

16 Feb '19

openSUSE Security Update: Security update for docker ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0189-1 Rating: moderate References: #1001161 #1112980 #1115464 #1118897 #1118898 #1118899 #1118990 #1121412 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has 5 fixes is now available. Description: This update for containerd, docker, docker-runc and golang-github-docker-libnetwork fixes the following issues: Security issues fixed for containerd, docker, docker-runc and golang-github-docker-libnetwork: - CVE-2018-16873: cmd/go: remote command execution during "go get -u" (bsc#1118897) - CVE-2018-16874: cmd/go: directory traversal in "go get" via curly braces in import paths (bsc#1118898) - CVE-2018-16875: crypto/x509: CPU denial of service (bsc#1118899) Non-security issues fixed for docker: - Disable leap based builds for kubic flavor (bsc#1121412) - Allow users to explicitly specify the NIS domainname of a container (bsc#1001161) - Update docker.service to match upstream and avoid rlimit problems (bsc#1112980) - Allow docker images larger then 23GB (bsc#1118990) - Docker version update to version 18.09.0-ce (bsc#1115464) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-189=1 Package List: - openSUSE Leap 15.0 (noarch): containerd-test-1.1.2-lp150.4.6.1 docker-bash-completion-18.09.0_ce-lp150.5.9.1 docker-runc-test-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.6.1 docker-zsh-completion-18.09.0_ce-lp150.5.9.1 - openSUSE Leap 15.0 (x86_64): containerd-1.1.2-lp150.4.6.1 containerd-ctr-1.1.2-lp150.4.6.1 docker-18.09.0_ce-lp150.5.9.1 docker-debuginfo-18.09.0_ce-lp150.5.9.1 docker-debugsource-18.09.0_ce-lp150.5.9.1 docker-libnetwork-0.7.0.1+gitr2704_6da50d197830-lp150.3.6.1 docker-libnetwork-debuginfo-0.7.0.1+gitr2704_6da50d197830-lp150.3.6.1 docker-runc-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.6.1 docker-runc-debuginfo-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.6.1 docker-test-18.09.0_ce-lp150.5.9.1 docker-test-debuginfo-18.09.0_ce-lp150.5.9.1 golang-github-docker-libnetwork-0.7.0.1+gitr2704_6da50d197830-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://bugzilla.suse.com/1001161 https://bugzilla.suse.com/1112980 https://bugzilla.suse.com/1115464 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899 https://bugzilla.suse.com/1118990 https://bugzilla.suse.com/1121412 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0182-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0182-1 Rating: important References: #1122983 Cross-References: CVE-2016-5824 CVE-2018-12405 CVE-2018-17466 CVE-2018-18492 CVE-2018-18493 CVE-2018-18494 CVE-2018-18498 CVE-2018-18500 CVE-2018-18501 CVE-2018-18505 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 60.5.0 fixes the following issues: Security vulnerabilities addressed (MFSA 2019-03 boo#1122983 MFSA 2018-31): - CVE-2018-18500: Use-after-free parsing HTML5 stream - CVE-2018-18505: Privilege escalation through IPC channel messages - CVE-2016-5824: DoS (use-after-free) via a crafted ics file - CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 - CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11 - CVE-2018-18492: Use-after-free with select element - CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia - CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs - CVE-2018-18498: Integer overflow when calculating buffer sizes for images - CVE-2018-12405: Memory safety bugs fixed in Firefox 64, 60.4, and Thunderbird 60.4 Other bugs fixed and changes made: - FileLink provider WeTransfer to upload large attachments - Thunderbird now allows the addition of OpenSearch search engines from a local XML file using a minimal user inferface: [+] button to select a file an add, [-] to remove. - More search engines: Google and DuckDuckGo available by default in some locales - During account creation, Thunderbird will now detect servers using the Microsoft Exchange protocol. It will offer the installation of a 3rd party add-on (Owl) which supports that protocol. - Thunderbird now compatible with other WebExtension-based FileLink add-ons like the Dropbox add-on - New WebExtensions FileLink API to facilitate add-ons - Fix decoding problems for messages with less common charsets (cp932, cp936) - New messages in the drafts folder (and other special or virtual folders) will no longer be included in the new messages notification - Thunderbird 60 will migrate security databases (key3.db, cert8.db to key4.db, cert9.db). Thunderbird 60.3.2 and earlier contained a fault that potentially deleted saved passwords and private certificate keys for users using a master password. Version 60.3.3 will prevent the loss of data; affected users who have already upgraded to version 60.3.2 or earlier can restore the deleted key3.db file from backup to complete the migration. - Address book search and auto-complete slowness introduced in Thunderbird 60.3.2 - Plain text markup with * for bold, / for italics, _ for underline and | for code did not work when the enclosed text contained non-ASCII characters - While composing a message, a link not removed when link location was removed in the link properties panel - Encoding problems when exporting address books or messages using the system charset. Messages are now always exported using the UTF-8 encoding - If the "Date" header of a message was invalid, Jan 1970 or Dec 1969 was displayed. Now using date from "Received" header instead. - Body search/filtering didn't reliably ignore content of tags - Inappropriate warning "Thunderbird prevented the site (addons.thunderbird.net) from asking you to install software on your computer" when installing add-ons - Incorrect display of correspondents column since own email address was not always detected - Spurious 
 (encoded newline) inserted into drafts and sent email - Double-clicking on a word in the Write window sometimes launched the Advanced Property Editor or Link Properties dialog - Fixe Cookie removal - "Download rest of message" was not working if global inbox was used - Fix Encoding problems for users (especially in Poland) when a file was sent via a folder using "Sent to > Mail recipient" due to a problem in the Thunderbird MAPI interface - According to RFC 4616 and RFC 5721, passwords containing non-ASCII characters are encoded using UTF-8 which can lead to problems with non-compliant providers, for example office365.com. The SMTP LOGIN and POP3 USER/PASS authentication methods are now using a Latin-1 encoding again to work around this issue - Fix shutdown crash/hang after entering an empty IMAP password Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-182=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaThunderbird-60.5.0-83.1 MozillaThunderbird-buildsymbols-60.5.0-83.1 MozillaThunderbird-debuginfo-60.5.0-83.1 MozillaThunderbird-debugsource-60.5.0-83.1 MozillaThunderbird-translations-common-60.5.0-83.1 MozillaThunderbird-translations-other-60.5.0-83.1 References: https://www.suse.com/security/cve/CVE-2016-5824.html https://www.suse.com/security/cve/CVE-2018-12405.html https://www.suse.com/security/cve/CVE-2018-17466.html https://www.suse.com/security/cve/CVE-2018-18492.html https://www.suse.com/security/cve/CVE-2018-18493.html https://www.suse.com/security/cve/CVE-2018-18494.html https://www.suse.com/security/cve/CVE-2018-18498.html https://www.suse.com/security/cve/CVE-2018-18500.html https://www.suse.com/security/cve/CVE-2018-18501.html https://www.suse.com/security/cve/CVE-2018-18505.html https://bugzilla.suse.com/1122983 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0183-1: important: Security update for mozilla-nss
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0183-1 Rating: important References: #1119069 Cross-References: CVE-2018-12404 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mozilla-nss fixes the following issues: Security issues fixed: - CVE-2018-12404: Cache side-channel variant of the Bleichenbacher attack (bsc#1119069). Non-security issue fixed: - Update to mozilla-nss 3.41.1 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-183=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libfreebl3-3.41.1-lp150.2.16.1 libfreebl3-debuginfo-3.41.1-lp150.2.16.1 libfreebl3-hmac-3.41.1-lp150.2.16.1 libsoftokn3-3.41.1-lp150.2.16.1 libsoftokn3-debuginfo-3.41.1-lp150.2.16.1 libsoftokn3-hmac-3.41.1-lp150.2.16.1 mozilla-nss-3.41.1-lp150.2.16.1 mozilla-nss-certs-3.41.1-lp150.2.16.1 mozilla-nss-certs-debuginfo-3.41.1-lp150.2.16.1 mozilla-nss-debuginfo-3.41.1-lp150.2.16.1 mozilla-nss-debugsource-3.41.1-lp150.2.16.1 mozilla-nss-devel-3.41.1-lp150.2.16.1 mozilla-nss-sysinit-3.41.1-lp150.2.16.1 mozilla-nss-sysinit-debuginfo-3.41.1-lp150.2.16.1 mozilla-nss-tools-3.41.1-lp150.2.16.1 mozilla-nss-tools-debuginfo-3.41.1-lp150.2.16.1 - openSUSE Leap 15.0 (x86_64): libfreebl3-32bit-3.41.1-lp150.2.16.1 libfreebl3-32bit-debuginfo-3.41.1-lp150.2.16.1 libfreebl3-hmac-32bit-3.41.1-lp150.2.16.1 libsoftokn3-32bit-3.41.1-lp150.2.16.1 libsoftokn3-32bit-debuginfo-3.41.1-lp150.2.16.1 libsoftokn3-hmac-32bit-3.41.1-lp150.2.16.1 mozilla-nss-32bit-3.41.1-lp150.2.16.1 mozilla-nss-32bit-debuginfo-3.41.1-lp150.2.16.1 mozilla-nss-certs-32bit-3.41.1-lp150.2.16.1 mozilla-nss-certs-32bit-debuginfo-3.41.1-lp150.2.16.1 mozilla-nss-sysinit-32bit-3.41.1-lp150.2.16.1 mozilla-nss-sysinit-32bit-debuginfo-3.41.1-lp150.2.16.1 References: https://www.suse.com/security/cve/CVE-2018-12404.html https://bugzilla.suse.com/1119069 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0184-1: moderate: Security update for python
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0184-1 Rating: moderate References: #1122191 Cross-References: CVE-2019-5010 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python fixes the following issues: Security issue fixed: - CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-184=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libpython2_7-1_0-2.7.14-lp150.6.6.1 libpython2_7-1_0-debuginfo-2.7.14-lp150.6.6.1 python-2.7.14-lp150.6.6.1 python-base-2.7.14-lp150.6.6.1 python-base-debuginfo-2.7.14-lp150.6.6.1 python-base-debugsource-2.7.14-lp150.6.6.1 python-curses-2.7.14-lp150.6.6.1 python-curses-debuginfo-2.7.14-lp150.6.6.1 python-debuginfo-2.7.14-lp150.6.6.1 python-debugsource-2.7.14-lp150.6.6.1 python-demo-2.7.14-lp150.6.6.1 python-devel-2.7.14-lp150.6.6.1 python-gdbm-2.7.14-lp150.6.6.1 python-gdbm-debuginfo-2.7.14-lp150.6.6.1 python-idle-2.7.14-lp150.6.6.1 python-tk-2.7.14-lp150.6.6.1 python-tk-debuginfo-2.7.14-lp150.6.6.1 python-xml-2.7.14-lp150.6.6.1 python-xml-debuginfo-2.7.14-lp150.6.6.1 - openSUSE Leap 15.0 (x86_64): libpython2_7-1_0-32bit-2.7.14-lp150.6.6.1 libpython2_7-1_0-32bit-debuginfo-2.7.14-lp150.6.6.1 python-32bit-2.7.14-lp150.6.6.1 python-32bit-debuginfo-2.7.14-lp150.6.6.1 python-base-32bit-2.7.14-lp150.6.6.1 python-base-32bit-debuginfo-2.7.14-lp150.6.6.1 - openSUSE Leap 15.0 (noarch): python-doc-2.7.14-lp150.6.6.1 python-doc-pdf-2.7.14-lp150.6.6.1 References: https://www.suse.com/security/cve/CVE-2019-5010.html https://bugzilla.suse.com/1122191 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0185-1: moderate: Security update for rmt-server
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for rmt-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0185-1 Rating: moderate References: #1102046 #1102193 #1109307 #1113760 #1113969 #1114831 #1117106 #1118579 #1118584 Cross-References: CVE-2018-14404 CVE-2018-16468 CVE-2018-16470 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has 6 fixes is now available. Description: This update for rmt-server to version 1.1.1 fixes the following issues: The following issues have been fixed: - Fixed migration problems which caused some extensions / modules to be dropped (bsc#1118584, bsc#1118579) - Fixed listing of mirrored products (bsc#1102193) - Include online migration paths into offline migration (bsc#1117106) - Sync products that do not have a base product (bsc#1109307) - Fixed SLP auto discovery for RMT (bsc#1113760) Update dependencies for security fixes: - CVE-2018-16468: Update loofah to 2.2.3 (bsc#1113969) - CVE-2018-16470: Update rack to 2.0.6 (bsc#1114831) - CVE-2018-14404: Update nokogiri to 1.8.5 (bsc#1102046) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-185=1 Package List: - openSUSE Leap 15.0 (x86_64): rmt-server-1.1.1-lp150.2.12.1 rmt-server-debuginfo-1.1.1-lp150.2.12.1 rmt-server-pubcloud-1.1.1-lp150.2.12.1 References: https://www.suse.com/security/cve/CVE-2018-14404.html https://www.suse.com/security/cve/CVE-2018-16468.html https://www.suse.com/security/cve/CVE-2018-16470.html https://bugzilla.suse.com/1102046 https://bugzilla.suse.com/1102193 https://bugzilla.suse.com/1109307 https://bugzilla.suse.com/1113760 https://bugzilla.suse.com/1113969 https://bugzilla.suse.com/1114831 https://bugzilla.suse.com/1117106 https://bugzilla.suse.com/1118579 https://bugzilla.suse.com/1118584 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0