February 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:0176-1: important: Security update for spice
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for spice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0176-1 Rating: important References: #1122706 Cross-References: CVE-2019-3813 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for spice fixes the following issues: Security issue fixed: - CVE-2019-3813: Fixed a out-of-bounds read in the memslot_get_virt function that could lead to denial-of-service or code-execution (bsc#1122706). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-176=1 Package List: - openSUSE Leap 42.3 (x86_64): libspice-server-devel-0.12.8-13.1 libspice-server1-0.12.8-13.1 libspice-server1-debuginfo-0.12.8-13.1 spice-debugsource-0.12.8-13.1 References: https://www.suse.com/security/cve/CVE-2019-3813.html https://bugzilla.suse.com/1122706 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0175-1: moderate: Security update for lua53
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for lua53 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0175-1 Rating: moderate References: #1123043 Cross-References: CVE-2019-6706 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lua53 fixes the following issues: Security issue fixed: - CVE-2019-6706: Fixed a use-after-free bug in the lua_upvaluejoin function of lapi.c (bsc#1123043) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-175=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): liblua5_3-5-5.3.4-lp150.2.3.1 liblua5_3-5-debuginfo-5.3.4-lp150.2.3.1 lua53-5.3.4-lp150.2.3.1 lua53-debuginfo-5.3.4-lp150.2.3.1 lua53-debugsource-5.3.4-lp150.2.3.1 lua53-devel-5.3.4-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): lua53-doc-5.3.4-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): liblua5_3-5-32bit-5.3.4-lp150.2.3.1 liblua5_3-5-32bit-debuginfo-5.3.4-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-6706.html https://bugzilla.suse.com/1123043 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0174-1: important: Security update for curl
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0174-1 Rating: important References: #1123371 #1123377 #1123378 Cross-References: CVE-2018-16890 CVE-2019-3822 CVE-2019-3823 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for curl fixes the following issues: Security issues fixed: - CVE-2019-3823: Fixed a heap out-of-bounds read in the code handling the end-of-response for SMTP (bsc#1123378). - CVE-2019-3822: Fixed a stack based buffer overflow in the function creating an outgoing NTLM type-3 message (bsc#1123377). - CVE-2018-16890: Fixed a heap buffer out-of-bounds read in the function handling incoming NTLM type-2 messages (bsc#1123371). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-174=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): curl-7.60.0-lp150.2.18.1 curl-debuginfo-7.60.0-lp150.2.18.1 curl-debugsource-7.60.0-lp150.2.18.1 curl-mini-7.60.0-lp150.2.18.1 curl-mini-debuginfo-7.60.0-lp150.2.18.1 curl-mini-debugsource-7.60.0-lp150.2.18.1 libcurl-devel-7.60.0-lp150.2.18.1 libcurl-mini-devel-7.60.0-lp150.2.18.1 libcurl4-7.60.0-lp150.2.18.1 libcurl4-debuginfo-7.60.0-lp150.2.18.1 libcurl4-mini-7.60.0-lp150.2.18.1 libcurl4-mini-debuginfo-7.60.0-lp150.2.18.1 - openSUSE Leap 15.0 (x86_64): libcurl-devel-32bit-7.60.0-lp150.2.18.1 libcurl4-32bit-7.60.0-lp150.2.18.1 libcurl4-32bit-debuginfo-7.60.0-lp150.2.18.1 References: https://www.suse.com/security/cve/CVE-2018-16890.html https://www.suse.com/security/cve/CVE-2019-3822.html https://www.suse.com/security/cve/CVE-2019-3823.html https://bugzilla.suse.com/1123371 https://bugzilla.suse.com/1123377 https://bugzilla.suse.com/1123378 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0173-1: important: Security update for curl
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0173-1 Rating: important References: #1123371 #1123377 #1123378 Cross-References: CVE-2018-16890 CVE-2019-3822 CVE-2019-3823 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for curl fixes the following issues: Security issues fixed: - CVE-2019-3823: Fixed a heap out-of-bounds read in the code handling the end-of-response for SMTP (bsc#1123378). - CVE-2019-3822: Fixed a stack based buffer overflow in the function creating an outgoing NTLM type-3 message (bsc#1123377). - CVE-2018-16890: Fixed a heap buffer out-of-bounds read in the function handling incoming NTLM type-2 messages (bsc#1123371). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-173=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): curl-7.37.0-45.1 curl-debuginfo-7.37.0-45.1 curl-debugsource-7.37.0-45.1 libcurl-devel-7.37.0-45.1 libcurl4-7.37.0-45.1 libcurl4-debuginfo-7.37.0-45.1 - openSUSE Leap 42.3 (x86_64): libcurl-devel-32bit-7.37.0-45.1 libcurl4-32bit-7.37.0-45.1 libcurl4-debuginfo-32bit-7.37.0-45.1 References: https://www.suse.com/security/cve/CVE-2018-16890.html https://www.suse.com/security/cve/CVE-2019-3822.html https://www.suse.com/security/cve/CVE-2019-3823.html https://bugzilla.suse.com/1123371 https://bugzilla.suse.com/1123377 https://bugzilla.suse.com/1123378 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0171-1: Security update for uriparser
by opensuse-security＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Security Update: Security update for uriparser ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0171-1 Rating: low References: #1115722 #1115723 #1115724 #1122193 Cross-References: CVE-2018-19198 CVE-2018-19199 CVE-2018-19200 CVE-2018-20721 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for uriparser fixes the following issues: Security issues fixed: - CVE-2018-20721: Fixed an out-of-bounds read for incomplete URIs with IPv6 addresses with embedded IPv4 address (bsc#1122193). - CVE-2018-19198: Fixed an out-of-bounds write that was possible via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115722). - CVE-2018-19199: Fixed an integer overflow caused by an unchecked multiplication via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115723). - CVE-2018-19200: Fixed a operation attempted on NULL input via a uriResetUri* function (bsc#1115724). This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-171=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): liburiparser1-0.8.5-bp150.2.3.1 uriparser-0.8.5-bp150.2.3.1 uriparser-devel-0.8.5-bp150.2.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): liburiparser1-64bit-0.8.5-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-19198.html https://www.suse.com/security/cve/CVE-2018-19199.html https://www.suse.com/security/cve/CVE-2018-19200.html https://www.suse.com/security/cve/CVE-2018-20721.html https://bugzilla.suse.com/1115722 https://bugzilla.suse.com/1115723 https://bugzilla.suse.com/1115724 https://bugzilla.suse.com/1122193 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0169-1: Security update for python-slixmpp
by opensuse-security＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Security Update: Security update for python-slixmpp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0169-1 Rating: low References: #1124322 Cross-References: CVE-2019-1000021 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-slixmpp fixes the following issue: Security issue fixed: - CVE-2019-1000021: Fixed incorrect Access Control vulnerability in XEP-0223 plugin (bsc#1124322) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-169=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): python3-slixmpp-1.3.0-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-1000021.html https://bugzilla.suse.com/1124322 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0170-1: important: Security update for runc
by opensuse-security＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Security Update: Security update for runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0170-1 Rating: important References: #1095817 #1118897 #1118898 #1118899 #1121967 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 CVE-2019-5736 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for runc fixes the following issues: Security vulnerabilities addressed: - CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967) - CVE-2018-16873: Fix a remote command execution during "go get -u" (boo#1118897) - CVE-2018-16874: Fix a directory traversal in "go get" via curly braces in import paths (boo#1118898) - CVE-2018-16875: Fix a CPU denial of service issue (boo#1118899) Other changes and bug fixes: - Update go requirements to >= go1.10 - Create a symlink in /usr/bin/runc to enable rootless Podman and Buildah. - Make use of %license macro - Remove 'go test' from %check section, as it has only ever caused us problems and hasn't (as far as I remember) ever caught a release-blocking issue. Smoke testing has been far more useful. (boo#1095817) - Upgrade to runc v1.0.0~rc6. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc6 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-170=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): runc-1.0.0~rc6-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): runc-test-1.0.0~rc6-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://www.suse.com/security/cve/CVE-2019-5736.html https://bugzilla.suse.com/1095817 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899 https://bugzilla.suse.com/1121967 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0166-1: important: Security update for haproxy
by opensuse-security＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Security Update: Security update for haproxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0166-1 Rating: important References: #1121283 Cross-References: CVE-2018-20615 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for haproxy version 1.8.17 fixes the following issues: Security issues fixed: - CVE-2018-20615: Fixed a denial of service, triggered by mishandling the priority flag on short HEADERS frame in the HTTP/2 decoder (bsc#1121283) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-166=1 Package List: - openSUSE Leap 15.0 (x86_64): haproxy-1.8.17~git0.e89d25b2-lp150.2.9.1 haproxy-debuginfo-1.8.17~git0.e89d25b2-lp150.2.9.1 haproxy-debugsource-1.8.17~git0.e89d25b2-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-20615.html https://bugzilla.suse.com/1121283 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0167-1: important: Security update for spice
by opensuse-security＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Security Update: Security update for spice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0167-1 Rating: important References: #1109044 #1122706 Cross-References: CVE-2019-3813 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for spice fixes the following issues: Security issue fixed: - CVE-2019-3813: Fixed a out-of-bounds read in the memslot_get_virt function that could lead to denial-of-service or code-execution (bsc#1122706). Non-security issue fixed: - Include spice-server tweak to compensate for performance issues with Windows guests (bsc#1109044). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-167=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libspice-server-devel-0.14.0-lp150.3.6.1 libspice-server1-0.14.0-lp150.3.6.1 libspice-server1-debuginfo-0.14.0-lp150.3.6.1 spice-debugsource-0.14.0-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-3813.html https://bugzilla.suse.com/1109044 https://bugzilla.suse.com/1122706 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0165-1: Security update for uriparser
by opensuse-security＠opensuse.org 13 Feb '19

13 Feb '19

openSUSE Security Update: Security update for uriparser ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0165-1 Rating: low References: #1115722 #1115723 #1115724 #1122193 Cross-References: CVE-2018-19198 CVE-2018-19199 CVE-2018-19200 CVE-2018-20721 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for uriparser fixes the following issues: Security issues fixed: - CVE-2018-20721: Fixed an out-of-bounds read for incomplete URIs with IPv6 addresses with embedded IPv4 address (bsc#1122193). - CVE-2018-19198: Fixed an out-of-bounds write that was possible via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115722). - CVE-2018-19199: Fixed an integer overflow caused by an unchecked multiplication via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115723). - CVE-2018-19200: Fixed a operation attempted on NULL input via a uriResetUri* function (bsc#1115724). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-165=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): liburiparser1-0.8.5-lp150.2.3.1 liburiparser1-debuginfo-0.8.5-lp150.2.3.1 uriparser-0.8.5-lp150.2.3.1 uriparser-debuginfo-0.8.5-lp150.2.3.1 uriparser-debugsource-0.8.5-lp150.2.3.1 uriparser-devel-0.8.5-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): liburiparser1-32bit-0.8.5-lp150.2.3.1 liburiparser1-32bit-debuginfo-0.8.5-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-19198.html https://www.suse.com/security/cve/CVE-2018-19199.html https://www.suse.com/security/cve/CVE-2018-19200.html https://www.suse.com/security/cve/CVE-2018-20721.html https://bugzilla.suse.com/1115722 https://bugzilla.suse.com/1115723 https://bugzilla.suse.com/1115724 https://bugzilla.suse.com/1122193 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0