March 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:1058-1: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1058-1 Rating: low References: #1128649 Cross-References: CVE-2019-7175 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issue: Security issues fixed: - CVE-2019-7175: Fixed multiple memory leaks in DecodeImage function (bsc#1128649). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1058=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-129.1 GraphicsMagick-debuginfo-1.3.25-129.1 GraphicsMagick-debugsource-1.3.25-129.1 GraphicsMagick-devel-1.3.25-129.1 libGraphicsMagick++-Q16-12-1.3.25-129.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-129.1 libGraphicsMagick++-devel-1.3.25-129.1 libGraphicsMagick-Q16-3-1.3.25-129.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-129.1 libGraphicsMagick3-config-1.3.25-129.1 libGraphicsMagickWand-Q16-2-1.3.25-129.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-129.1 perl-GraphicsMagick-1.3.25-129.1 perl-GraphicsMagick-debuginfo-1.3.25-129.1 References: https://www.suse.com/security/cve/CVE-2019-7175.html https://bugzilla.suse.com/1128649 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1059-1: moderate: Security update for lftp
by opensuse-security＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Security Update: Security update for lftp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1059-1 Rating: moderate References: #1103367 #1120946 Cross-References: CVE-2018-10916 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for lftp fixes the following issues: Security issue fixed: - CVE-2018-10916: Fixed an improper file name sanitization which could lead to loss of integrity of the local system (bsc#1103367). Other issue addressed: - The SSH login handling code detects password prompts more reliably (bsc#1120946). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1059=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): lftp-4.7.4-2.6.1 lftp-debuginfo-4.7.4-2.6.1 lftp-debugsource-4.7.4-2.6.1 References: https://www.suse.com/security/cve/CVE-2018-10916.html https://bugzilla.suse.com/1103367 https://bugzilla.suse.com/1120946 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1056-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 27 Mar '19

27 Mar '19

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1056-1 Rating: important References: #1129821 #1130262 Cross-References: CVE-2018-18506 CVE-2019-9788 CVE-2019-9790 CVE-2019-9791 CVE-2019-9792 CVE-2019-9793 CVE-2019-9794 CVE-2019-9795 CVE-2019-9796 CVE-2019-9810 CVE-2019-9813 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Mozilla Firefox was updated to 60.6.1esr (MFSA 2019-10 boo#1130262) * CVE-2019-9810: IonMonkey MArraySlice has incorrect alias information * CVE-2019-9813: Ionmonkey type confusion with __proto__ mutations Mozilla Firefox was updated to 60.6.0esr (MFSA 2019-08 boo#1129821) * CVE-2019-9790: Use-after-free when removing in-use DOM elements * CVE-2019-9791: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey * CVE-2019-9792: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script * CVE-2019-9793: Improper bounds checks when Spectre mitigations are disabled * CVE-2019-9794: Command line arguments not discarded during execution * CVE-2019-9795: Type-confusion in IonMonkey JIT compiler * CVE-2019-9796: Use-after-free with SMIL animation controller * CVE-2018-18506: Proxy Auto-Configuration file can define localhost access to be proxied * CVE-2019-9788: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 Mozilla Firefox was updated to 60.5.2esr: * Fix a frequent crash when reading various Reuters news articles Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1056=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-60.6.1-135.1 MozillaFirefox-branding-upstream-60.6.1-135.1 MozillaFirefox-buildsymbols-60.6.1-135.1 MozillaFirefox-debuginfo-60.6.1-135.1 MozillaFirefox-debugsource-60.6.1-135.1 MozillaFirefox-devel-60.6.1-135.1 MozillaFirefox-translations-common-60.6.1-135.1 MozillaFirefox-translations-other-60.6.1-135.1 References: https://www.suse.com/security/cve/CVE-2018-18506.html https://www.suse.com/security/cve/CVE-2019-9788.html https://www.suse.com/security/cve/CVE-2019-9790.html https://www.suse.com/security/cve/CVE-2019-9791.html https://www.suse.com/security/cve/CVE-2019-9792.html https://www.suse.com/security/cve/CVE-2019-9793.html https://www.suse.com/security/cve/CVE-2019-9794.html https://www.suse.com/security/cve/CVE-2019-9795.html https://www.suse.com/security/cve/CVE-2019-9796.html https://www.suse.com/security/cve/CVE-2019-9810.html https://www.suse.com/security/cve/CVE-2019-9813.html https://bugzilla.suse.com/1129821 https://bugzilla.suse.com/1130262 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1049-1: moderate: Security update for aubio
by opensuse-security＠opensuse.org 25 Mar '19

25 Mar '19

openSUSE Security Update: Security update for aubio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1049-1 Rating: moderate References: #1102359 #1102364 Cross-References: CVE-2018-14522 CVE-2018-14523 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for aubio fixes the following issues: - CVE-2018-14522: Fixed a crash in aubio_pitch_set_unit (bsc#1102359) - CVE-2018-14523: Fixed a buffer overrread resulting in crash or information leakage in new_aubio_pitchyinfft (bsc#1102364) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1049=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): aubio-debugsource-0.4.1-bp150.3.6.1 aubio-tools-0.4.1-bp150.3.6.1 aubio-tools-debuginfo-0.4.1-bp150.3.6.1 libaubio-devel-0.4.1-bp150.3.6.1 libaubio4-0.4.1-bp150.3.6.1 libaubio4-debuginfo-0.4.1-bp150.3.6.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libaubio4-64bit-0.4.1-bp150.3.6.1 libaubio4-64bit-debuginfo-0.4.1-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-14522.html https://www.suse.com/security/cve/CVE-2018-14523.html https://bugzilla.suse.com/1102359 https://bugzilla.suse.com/1102364 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1050-1: moderate: Security update for blueman
by opensuse-security＠opensuse.org 25 Mar '19

25 Mar '19

openSUSE Security Update: Security update for blueman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1050-1 Rating: moderate References: #1083066 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for blueman fixes the following issues: The following security issue was addressed: - Fixed the polkit authorization checks in blueman, which previously allowed any user with access to the D-Bus system bus to trigger certain network configuration logic in blueman without authentication (boo#1083066). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1050=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): blueman-2.0.6-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): blueman-lang-2.0.6-bp150.2.3.1 thunar-sendto-blueman-2.0.6-bp150.2.3.1 References: https://bugzilla.suse.com/1083066 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1050-1: moderate: Security update for blueman
by opensuse-security＠opensuse.org 25 Mar '19

25 Mar '19

openSUSE Security Update: Security update for blueman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1050-1 Rating: moderate References: #1083066 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for blueman fixes the following issues: The following security issue was addressed: - Fixed the polkit authorization checks in blueman, which previously allowed any user with access to the D-Bus system bus to trigger certain network configuration logic in blueman without authentication (boo#1083066). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1050=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): blueman-2.0.6-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): blueman-lang-2.0.6-bp150.2.3.1 thunar-sendto-blueman-2.0.6-bp150.2.3.1 References: https://bugzilla.suse.com/1083066 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1049-1: moderate: Security update for aubio
by opensuse-security＠opensuse.org 25 Mar '19

25 Mar '19

openSUSE Security Update: Security update for aubio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1049-1 Rating: moderate References: #1102359 #1102364 Cross-References: CVE-2018-14522 CVE-2018-14523 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for aubio fixes the following issues: - CVE-2018-14522: Fixed a crash in aubio_pitch_set_unit (bsc#1102359) - CVE-2018-14523: Fixed a buffer overrread resulting in crash or information leakage in new_aubio_pitchyinfft (bsc#1102364) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1049=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): aubio-debugsource-0.4.1-bp150.3.6.1 aubio-tools-0.4.1-bp150.3.6.1 aubio-tools-debuginfo-0.4.1-bp150.3.6.1 libaubio-devel-0.4.1-bp150.3.6.1 libaubio4-0.4.1-bp150.3.6.1 libaubio4-debuginfo-0.4.1-bp150.3.6.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libaubio4-64bit-0.4.1-bp150.3.6.1 libaubio4-64bit-debuginfo-0.4.1-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-14522.html https://www.suse.com/security/cve/CVE-2018-14523.html https://bugzilla.suse.com/1102359 https://bugzilla.suse.com/1102364 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1051-1: moderate: Security update for kauth
by opensuse-security＠opensuse.org 25 Mar '19

25 Mar '19

openSUSE Security Update: Security update for kauth ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1051-1 Rating: moderate References: #1124863 Cross-References: CVE-2019-7443 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kauth fixes the following issues: Security issue fixed: - CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants (bsc#1124863). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1051=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): kauth-debugsource-5.32.0-bp150.3.10.1 kauth-devel-5.32.0-bp150.3.10.1 kcoreaddons-5.32.0-bp150.3.3.1 kcoreaddons-debugsource-5.32.0-bp150.3.3.1 kcoreaddons-devel-5.32.0-bp150.3.3.1 kcoreaddons-devel-debuginfo-5.32.0-bp150.3.3.1 libKF5Auth5-5.32.0-bp150.3.10.1 libKF5Auth5-debuginfo-5.32.0-bp150.3.10.1 libKF5CoreAddons5-5.32.0-bp150.3.3.1 libKF5CoreAddons5-debuginfo-5.32.0-bp150.3.3.1 libpolkit-qt5-1-1-0.112.0-bp150.3.3.1 libpolkit-qt5-1-devel-0.112.0-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): kauth-devel-64bit-5.32.0-bp150.3.10.1 kcoreaddons-devel-64bit-5.32.0-bp150.3.3.1 kcoreaddons-devel-64bit-debuginfo-5.32.0-bp150.3.3.1 libKF5Auth5-64bit-5.32.0-bp150.3.10.1 libKF5Auth5-64bit-debuginfo-5.32.0-bp150.3.10.1 libKF5CoreAddons5-64bit-5.32.0-bp150.3.3.1 libKF5CoreAddons5-64bit-debuginfo-5.32.0-bp150.3.3.1 libpolkit-qt5-1-1-64bit-0.112.0-bp150.3.3.1 libpolkit-qt5-1-devel-64bit-0.112.0-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): kcoreaddons-lang-5.32.0-bp150.3.3.1 libKF5Auth5-lang-5.32.0-bp150.3.10.1 References: https://www.suse.com/security/cve/CVE-2019-7443.html https://bugzilla.suse.com/1124863 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0348-1: important: Security update for ovmf
by opensuse-security＠opensuse.org 19 Mar '19

19 Mar '19

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0348-1 Rating: important References: #1127820 #1127821 #1127822 Cross-References: CVE-2018-12178 CVE-2018-12180 CVE-2018-3630 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for ovmf fixes the following issues: Security issues fixed: - CVE-2018-12180: Fixed a buffer overflow in BlockIo service, which could lead to memory read/write overrun (bsc#1127820). - CVE-2018-12178: Fixed an improper DNS check upon receiving a new DNS packet (bsc#1127821). - CVE-2018-3630: Fixed a logic error in FV parsing which could allow a local attacker to bypass the chain of trust checks (bsc#1127822). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-348=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ovmf-2017+git1492060560.b6d11d7c46-16.1 ovmf-tools-2017+git1492060560.b6d11d7c46-16.1 - openSUSE Leap 42.3 (x86_64): qemu-ovmf-x86_64-debug-2017+git1492060560.b6d11d7c46-16.1 - openSUSE Leap 42.3 (noarch): qemu-ovmf-ia32-2017+git1492060560.b6d11d7c46-16.1 qemu-ovmf-x86_64-2017+git1492060560.b6d11d7c46-16.1 References: https://www.suse.com/security/cve/CVE-2018-12178.html https://www.suse.com/security/cve/CVE-2018-12180.html https://www.suse.com/security/cve/CVE-2018-3630.html https://bugzilla.suse.com/1127820 https://bugzilla.suse.com/1127821 https://bugzilla.suse.com/1127822 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0346-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 18 Mar '19

18 Mar '19

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0346-1 Rating: important References: #1122293 #1122299 Cross-References: CVE-2018-11212 CVE-2019-2422 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for java-1_8_0-openjdk to version jdk8u201 (icedtea 3.11.0) fixes the following issues: Security issues fixed: - CVE-2019-2422: Fixed a memory disclosure in FileChannelImpl (bsc#1122293). - CVE-2018-11212: Fixed an issue in alloc_sarray function in jmemmgr.c (bsc#1122299). Complete list of changes: https://mail.openjdk.java.net/pipermail/distro-pkg-dev/2019-March/041223.ht ml This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-346=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): java-1_8_0-openjdk-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-accessibility-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-debuginfo-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-debugsource-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-demo-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-devel-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-headless-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-src-1.8.0.201-lp150.2.12.1 - openSUSE Leap 15.0 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.201-lp150.2.12.1 References: https://www.suse.com/security/cve/CVE-2018-11212.html https://www.suse.com/security/cve/CVE-2019-2422.html https://bugzilla.suse.com/1122293 https://bugzilla.suse.com/1122299 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0