March 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:1084-1: moderate: Security update for ucode-intel
by opensuse-security＠opensuse.org 30 Mar '19

30 Mar '19

openSUSE Security Update: Security update for ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1084-1 Rating: moderate References: #1129231 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for ucode-intel fixes the following issues: Updated to the 20190312 bundle release (bsc#1129231) New Platforms: - AML-Y22 H0 6-8e-9/10 0000009e Core Gen8 Mobile - WHL-U W0 6-8e-b/d0 000000a4 Core Gen8 Mobile - WHL-U V0 6-8e-d/94 000000b2 Core Gen8 Mobile - CFL-S P0 6-9e-c/22 000000a2 Core Gen9 Desktop - CFL-H R0 6-9e-d/22 000000b0 Core Gen9 Mobile Updated Platforms: - HSX-E/EP Cx/M1 6-3f-2/6f 0000003d->00000041 Core Gen4 X series; Xeon E5 v3 - HSX-EX E0 6-3f-4/80 00000012->00000013 Xeon E7 v3 - SKX-SP H0/M0/U0 6-55-4/b7 0200004d->0000005a Xeon Scalable - SKX-D M1 6-55-4/b7 0200004d->0000005a Xeon D-21xx - BDX-DE V1 6-56-2/10 00000017->00000019 Xeon D-1520/40 - BDX-DE V2/3 6-56-3/10 07000013->07000016 Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 - BDX-DE Y0 6-56-4/10 0f000012->0f000014 Xeon D-1557/59/67/71/77/81/87 - BDX-NS A0 6-56-5/10 0e00000a->0e00000c Xeon D-1513N/23/33/43/53 - APL D0 6-5c-9/03 00000032->00000036 Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx - APL E0 6-5c-a/03 0000000c->00000010 Atom x5/7-E39xx - GLK B0 6-7a-1/01 00000028->0000002c Pentium Silver N/J5xxx, Celeron N/J4xxx - KBL-U/Y H0 6-8e-9/c0 0000008e->0000009a Core Gen7 Mobile - CFL-U43e D0 6-8e-a/c0 00000096->0000009e Core Gen8 Mobile - KBL-H/S/E3 B0 6-9e-9/2a 0000008e->0000009a Core Gen7; Xeon E3 v6 - CFL-H/S/E3 U0 6-9e-a/22 00000096->000000aa Core Gen8 Desktop, Mobile, Xeon E - CFL-S B0 6-9e-b/02 0000008e->000000aa Core Gen8 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1084=1 Package List: - openSUSE Leap 15.0 (x86_64): ucode-intel-20190312-lp150.2.14.1 References: https://bugzilla.suse.com/1129231 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1083-1: important: Security update for ovmf
by opensuse-security＠opensuse.org 30 Mar '19

30 Mar '19

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1083-1 Rating: important References: #1127820 #1127821 #1127822 Cross-References: CVE-2018-12178 CVE-2018-12180 CVE-2018-3630 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for ovmf fixes the following issues: Security issues fixed: - CVE-2018-12180: Fixed a buffer overflow in BlockIo service, which could lead to memory read/write overrun (bsc#1127820). - CVE-2018-12178: Fixed an improper DNS check upon receiving a new DNS packet (bsc#1127821). - CVE-2018-3630: Fixed a logic error in FV parsing which could allow a local attacker to bypass the chain of trust checks (bsc#1127822). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1083=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ovmf-2017+git1510945757.b2662641d5-lp150.4.13.1 ovmf-tools-2017+git1510945757.b2662641d5-lp150.4.13.1 - openSUSE Leap 15.0 (noarch): qemu-ovmf-ia32-2017+git1510945757.b2662641d5-lp150.4.13.1 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-lp150.4.13.1 - openSUSE Leap 15.0 (x86_64): qemu-ovmf-x86_64-debug-2017+git1510945757.b2662641d5-lp150.4.13.1 References: https://www.suse.com/security/cve/CVE-2018-12178.html https://www.suse.com/security/cve/CVE-2018-12180.html https://www.suse.com/security/cve/CVE-2018-3630.html https://bugzilla.suse.com/1127820 https://bugzilla.suse.com/1127821 https://bugzilla.suse.com/1127822 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1085-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 30 Mar '19

30 Mar '19

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1085-1 Rating: important References: #1012382 #1020413 #1065600 #1070767 #1075697 #1082943 #1087092 #1090435 #1102959 #1103429 #1106929 #1109137 #1109248 #1119019 #1119843 #1120691 #1120902 #1121713 #1121805 #1124235 #1125315 #1125446 #1126389 #1126772 #1126773 #1126805 #1127082 #1127155 #1127561 #1127725 #1127731 #1127961 #1128166 #1128452 #1128565 #1128696 #1128756 #1128893 #1129080 #1129179 #1129237 #1129238 #1129239 #1129240 #1129241 #1129413 #1129414 #1129415 #1129416 #1129417 #1129418 #1129419 #1129581 #1129770 #1129923 Cross-References: CVE-2019-2024 CVE-2019-9213 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 53 fixes is now available. Description: The openSUSE Leap 42.3 kernel was updated to 4.4.176 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166). - CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179). The following non-security bugs were fixed: - ax25: fix possible use-after-free (bnc#1012382). - block_dev: fix crash on chained bios with O_DIRECT (bsc#1090435). - block: do not use bio->bi_vcnt to figure out segment number (bsc#1128893). - bnxt_re: Fix couple of memory leaks that could lead to IOMMU call traces (bsc#1020413). - bpf: fix replace_map_fd_with_map_ptr's ldimm64 second imm field (bsc#1012382). - btrfs: ensure that a DUP or RAID1 block group has exactly two stripes (bsc#1128452). - ceph: avoid repeatedly adding inode to mdsc->snap_flush_list (bsc#1126773). - ch: add missing mutex_lock()/mutex_unlock() in ch_release() (bsc#1124235). - ch: fixup refcounting imbalance for SCSI devices (bsc#1124235). - copy_mount_string: Limit string length to PATH_MAX (bsc#1082943). - device property: Fix the length used in PROPERTY_ENTRY_STRING() (bsc#1129770). - Drivers: hv: vmbus: Check for ring when getting debug info (bsc#1126389). - drm: Fix error handling in drm_legacy_addctx (bsc#1106929) - drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON (bsc#1106929) - drm/nouveau/pmu: do not print reply values if exec is false (bsc#1106929) - drm/radeon/evergreen_cs: fix missing break in switch statement (bsc#1106929) - drm/vmwgfx: Do not double-free the mode stored in par->set_mode (bsc#1103429) - enic: add wq clean up budget (bsc#1075697, bsc#1120691. bsc#1102959). - enic: do not overwrite error code (bnc#1012382). - fbdev: chipsfb: remove set but not used variable 'size' (bsc#1106929) - ibmvnic: Report actual backing device speed and duplex values (bsc#1129923). - ibmvscsi: Fix empty event pool access during host removal (bsc#1119019). - Input: mms114 - fix license module information (bsc#1087092). - iommu/dmar: Fix buffer overflow during PCI bus notification (bsc#1129237). - iommu/io-pgtable-arm-v7s: Only kmemleak_ignore L2 tables (bsc#1129238). - iommu/vt-d: Check identity map for hot-added devices (bsc#1129239). - iommu/vt-d: Fix NULL pointer reference in intel_svm_bind_mm() (bsc#1129240). - ixgbe: fix crash in build_skb Rx code path (git-fixes). - kABI: protect struct inet_peer (kabi). - kallsyms: Handle too long symbols in kallsyms.c (bsc#1126805). - KMPs: obsolete older KMPs of the same flavour (bsc#1127155, bsc#1109137). - KVM: arm/arm64: vgic-its: Check CBASER/BASER validity before enabling the ITS (bsc#1109248). - KVM: arm/arm64: vgic-its: Check GITS_BASER Valid bit before saving tables (bsc#1109248). - KVM: arm/arm64: vgic-its: Fix return value for device table restore (bsc#1109248). - KVM: arm/arm64: vgic-its: Fix vgic_its_restore_collection_table returned value (bsc#1109248). - kvm: nVMX: Do not halt vcpu when L1 is injecting events to L2 (bsc#1129413). - kvm: nVMX: Free the VMREAD/VMWRITE bitmaps if alloc_kvm_area() fails (bsc#1129414). - kvm: nVMX: NMI-window and interrupt-window exiting should wake L2 from HLT (bsc#1129415). - kvm: nVMX: Set VM instruction error for VMPTRLD of unbacked page (bsc#1129416). - kvm: VMX: Do not allow reexecute_instruction() when skipping MMIO instr (bsc#1129417). - kvm: vmx: Set IA32_TSC_AUX for legacy mode guests (bsc#1129418). - kvm: x86: Add AMD's EX_CFG to the list of ignored MSRs (bsc#1127082). - kvm: x86: IA32_ARCH_CAPABILITIES is always supported (bsc#1129419). - libceph: handle an empty authorize reply (bsc#1126772). - mdio_bus: Fix use-after-free on device_register fails (git-fixes). - mfd: as3722: Handle interrupts on suspend (bnc#1012382). - mfd: as3722: Mark PM functions as __maybe_unused (bnc#1012382). - mISDN: fix a race in dev_expire_timer() (bnc#1012382). - mlxsw: pci: Correctly determine if descriptor queue is full (git-fixes). - mlxsw: reg: Use correct offset in field definiton (git-fixes). - mm, devm_memremap_pages: mark devm_memremap_pages() EXPORT_SYMBOL_GPL (bnc#1012382). - mm,memory_hotplug: fix scan_movable_pages() for gigantic hugepages (bsc#1127731). - net: Add header for usage of fls64() (bnc#1012382). - net: Do not allocate page fragments that are not skb aligned (bnc#1012382). - net: dsa: bcm_sf2: Do not assume DSA master supports WoL (git-fixes). - net: dsa: mv88e6xxx: fix port VLAN maps (git-fixes). - net: Fix for_each_netdev_feature on Big endian (bnc#1012382). - net: fix IPv6 prefix route residue (bnc#1012382). - net/hamradio/6pack: Convert timers to use timer_setup() (git-fixes). - net/hamradio/6pack: use mod_timer() to rearm timers (git-fixes). - net: ipv4: use a dedicated counter for icmp_v4 redirect packets (bnc#1012382). - net: lan78xx: Fix race in tx pending skb size calculation (git-fixes). - net/mlx4_core: drop useless LIST_HEAD (git-fixes). - net/mlx4_core: Fix qp mtt size calculation (git-fixes). - net/mlx4_core: Fix reset flow when in command polling mode (git-fixes). - net/mlx4: Fix endianness issue in qp context params (git-fixes). - net/mlx5: Continue driver initialization despite debugfs failure (git-fixes). - net/mlx5e: Fix TCP checksum in LRO buffers (git-fixes). - net/mlx5: Fix driver load bad flow when having fw initializing timeout (git-fixes). - net/mlx5: fix uaccess beyond "count" in debugfs read/write handlers (git-fixes). - net/mlx5: Fix use-after-free in self-healing flow (git-fixes). - net/mlx5: Return success for PAGE_FAULT_RESUME in internal error state (git-fixes). - net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets (git-fixes). - net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS (git-fixes). - net: phy: bcm7xxx: Fix shadow mode 2 disabling (git-fixes). - net: qca_spi: Fix race condition in spi transfers (git-fixes). - net: stmmac: Fix a race in EEE enable callback (bnc#1012382). - net: stmmac: Fix a race in EEE enable callback (git-fixes). - net: thunderx: set tso_hdrs pointer to NULL in nicvf_free_snd_queue (git-fixes). - net/x25: do not hold the cpu too long in x25_new_lci() (bnc#1012382). - pci/pme: Fix hotplug/sysfs remove deadlock in pcie_pme_remove() (bsc#1129241). - perf/x86: Add sysfs entry to freeze counters on SMI (bsc#1121805). - perf/x86/intel: Delay memory deallocation until x86_pmu_dead_cpu() (bsc#1121805). - perf/x86/intel: Do not enable freeze-on-smi for PerfMon V1 (bsc#1121805). - perf/x86/intel: Fix memory corruption (bsc#1121805). - perf/x86/intel: Generalize dynamic constraint creation (bsc#1121805). - perf/x86/intel: Implement support for TSX Force Abort (bsc#1121805). - perf/x86/intel: Make cpuc allocations consistent (bsc#1121805). - phy: micrel: Ensure interrupts are reenabled on resume (git-fixes). - powerpc/pseries: Add CPU dlpar remove functionality (bsc#1128756). - powerpc/pseries: Consolidate CPU hotplug code to hotplug-cpu.c (bsc#1128756). - powerpc/pseries: Factor out common cpu hotplug code (bsc#1128756). - powerpc/pseries: Perform full re-add of CPU for topology update post-migration (bsc#1128756). - pppoe: fix reception of frames with no mac header (git-fixes). - pptp: dst_release sk_dst_cache in pptp_sock_destruct (git-fixes). - pseries/energy: Use OF accessor function to read ibm,drc-indexes (bsc#1129080). - RDMA/bnxt_re: Synchronize destroy_qp with poll_cq (bsc#1125446). - Refresh patches.suse/scsi-do-not-print-reservation-conflict-for-TEST-UNIT.patch (bsc#1119843) - Revert "mm, devm_memremap_pages: mark devm_memremap_pages() EXPORT_SYMBOL_GPL" (bnc#1012382). - Revert "x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls" (bsc#1128565). - s390/qeth: cancel close_dev work before removing a card (LTC#175898, bsc#1127561). - scsi: aacraid: Fix missing break in switch statement (bsc#1128696). - scsi: ibmvscsi: Fix empty event pool access during host removal (bsc#1119019). - scsi: lpfc: do not set queue->page_count to 0 if pc_sli4_params.wqpcnt is invalid (bsc#1127725). - scsi: qla2xxx: Fix early srb free on abort (bsc#1121713). - scsi: qla2xxx: Fix for double free of SRB structure (bsc#1121713). - scsi: qla2xxx: Increase abort timeout value (bsc#1121713). - scsi: qla2xxx: Move {get|rel}_sp to base_qpair struct (bsc#1121713). - scsi: qla2xxx: Return switch command on a timeout (bsc#1121713). - scsi: qla2xxx: Turn off IOCB timeout timer on IOCB completion (bsc#1121713). - scsi: qla2xxx: Use correct qpair for ABTS/CMD (bsc#1121713). - scsi: sym53c8xx: fix NULL pointer dereference panic in sym_int_sir() (bsc#1125315). - sky2: Increase D3 delay again (bnc#1012382). - tcp: clear icsk_backoff in tcp_write_queue_purge() (bnc#1012382). - tcp: tcp_v4_err() should be more careful (bnc#1012382). - team: avoid complex list operations in team_nl_cmd_options_set() (bnc#1012382). - team: Free BPF filter when unregistering netdev (git-fixes). - tracing: Do not free iter->trace in fail path of tracing_open_pipe() (bsc#1129581). - vsock: cope with memory allocation failure at socket creation time (bnc#1012382). - vxlan: test dev->flags & IFF_UP before calling netif_rx() (bnc#1012382). - wireless: airo: potential buffer overflow in sprintf() (bsc#1120902). - x86: Add TSX Force Abort CPUID/MSR (bsc#1121805). - x86: livepatch: Treat R_X86_64_PLT32 as R_X86_64_PC32 (bnc#1012382). - xen, cpu_hotplug: Prevent an out of bounds access (bsc#1065600). - xen: remove pre-xen3 fallback handlers (bsc#1065600). - xfs: remove filestream item xfs_inode reference (bsc#1127961). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1085=1 Package List: - openSUSE Leap 42.3 (x86_64): kernel-debug-4.4.176-96.1 kernel-debug-base-4.4.176-96.1 kernel-debug-base-debuginfo-4.4.176-96.1 kernel-debug-debuginfo-4.4.176-96.1 kernel-debug-debugsource-4.4.176-96.1 kernel-debug-devel-4.4.176-96.1 kernel-debug-devel-debuginfo-4.4.176-96.1 kernel-default-4.4.176-96.1 kernel-default-base-4.4.176-96.1 kernel-default-base-debuginfo-4.4.176-96.1 kernel-default-debuginfo-4.4.176-96.1 kernel-default-debugsource-4.4.176-96.1 kernel-default-devel-4.4.176-96.1 kernel-obs-build-4.4.176-96.1 kernel-obs-build-debugsource-4.4.176-96.1 kernel-obs-qa-4.4.176-96.1 kernel-syms-4.4.176-96.1 kernel-vanilla-4.4.176-96.1 kernel-vanilla-base-4.4.176-96.1 kernel-vanilla-base-debuginfo-4.4.176-96.1 kernel-vanilla-debuginfo-4.4.176-96.1 kernel-vanilla-debugsource-4.4.176-96.1 kernel-vanilla-devel-4.4.176-96.1 - openSUSE Leap 42.3 (noarch): kernel-devel-4.4.176-96.1 kernel-docs-4.4.176-96.1 kernel-docs-html-4.4.176-96.1 kernel-docs-pdf-4.4.176-96.1 kernel-macros-4.4.176-96.1 kernel-source-4.4.176-96.1 kernel-source-vanilla-4.4.176-96.1 References: https://www.suse.com/security/cve/CVE-2019-2024.html https://www.suse.com/security/cve/CVE-2019-9213.html https://bugzilla.suse.com/1012382 https://bugzilla.suse.com/1020413 https://bugzilla.suse.com/1065600 https://bugzilla.suse.com/1070767 https://bugzilla.suse.com/1075697 https://bugzilla.suse.com/1082943 https://bugzilla.suse.com/1087092 https://bugzilla.suse.com/1090435 https://bugzilla.suse.com/1102959 https://bugzilla.suse.com/1103429 https://bugzilla.suse.com/1106929 https://bugzilla.suse.com/1109137 https://bugzilla.suse.com/1109248 https://bugzilla.suse.com/1119019 https://bugzilla.suse.com/1119843 https://bugzilla.suse.com/1120691 https://bugzilla.suse.com/1120902 https://bugzilla.suse.com/1121713 https://bugzilla.suse.com/1121805 https://bugzilla.suse.com/1124235 https://bugzilla.suse.com/1125315 https://bugzilla.suse.com/1125446 https://bugzilla.suse.com/1126389 https://bugzilla.suse.com/1126772 https://bugzilla.suse.com/1126773 https://bugzilla.suse.com/1126805 https://bugzilla.suse.com/1127082 https://bugzilla.suse.com/1127155 https://bugzilla.suse.com/1127561 https://bugzilla.suse.com/1127725 https://bugzilla.suse.com/1127731 https://bugzilla.suse.com/1127961 https://bugzilla.suse.com/1128166 https://bugzilla.suse.com/1128452 https://bugzilla.suse.com/1128565 https://bugzilla.suse.com/1128696 https://bugzilla.suse.com/1128756 https://bugzilla.suse.com/1128893 https://bugzilla.suse.com/1129080 https://bugzilla.suse.com/1129179 https://bugzilla.suse.com/1129237 https://bugzilla.suse.com/1129238 https://bugzilla.suse.com/1129239 https://bugzilla.suse.com/1129240 https://bugzilla.suse.com/1129241 https://bugzilla.suse.com/1129413 https://bugzilla.suse.com/1129414 https://bugzilla.suse.com/1129415 https://bugzilla.suse.com/1129416 https://bugzilla.suse.com/1129417 https://bugzilla.suse.com/1129418 https://bugzilla.suse.com/1129419 https://bugzilla.suse.com/1129581 https://bugzilla.suse.com/1129770 https://bugzilla.suse.com/1129923 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1079-1: important: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc
by opensuse-security＠opensuse.org 29 Mar '19

29 Mar '19

openSUSE Security Update: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1079-1 Rating: important References: #1001161 #1048046 #1051429 #1112980 #1114832 #1118897 #1118898 #1118899 #1121412 #1121967 #1124308 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 CVE-2019-5736 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves four vulnerabilities and has 7 fixes is now available. Description: This update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc fixes the following issues: Security issues fixed: - CVE-2018-16875: Fixed a CPU Denial of Service (bsc#1118899). - CVE-2018-16874: Fixed a vulnerabity in go get command which could allow directory traversal in GOPATH mode (bsc#1118898). - CVE-2018-16873: Fixed a vulnerability in go get command which could allow remote code execution when executed with -u in GOPATH mode (bsc#1118897). - CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967). Other changes and bug fixes: - Update shell completion to use Group: System/Shells. - Add daemon.json file with rotation logs configuration (bsc#1114832) - Update to Docker 18.09.1-ce (bsc#1124308) and to to runc 96ec2177ae84. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. - Disable leap based builds for kubic flavor (bsc#1121412). - Allow users to explicitly specify the NIS domain name of a container (bsc#1001161). - Update docker.service to match upstream and avoid rlimit problems (bsc#1112980). - Update go requirements to >= go1.10 - Use -buildmode=pie for tests and binary build (bsc#1048046 and bsc#1051429). - Remove the usage of 'cp -r' to reduce noise in the build logs. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1079=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): containerd-1.2.2-22.1 containerd-ctr-1.2.2-22.1 containerd-kubic-1.2.2-22.1 containerd-kubic-ctr-1.2.2-22.1 docker-libnetwork-0.7.0.1+gitr2711_2cfbf9b1f981-11.1 docker-libnetwork-debuginfo-0.7.0.1+gitr2711_2cfbf9b1f981-11.1 docker-libnetwork-kubic-0.7.0.1+gitr2711_2cfbf9b1f981-11.1 docker-libnetwork-kubic-debuginfo-0.7.0.1+gitr2711_2cfbf9b1f981-11.1 docker-runc-1.0.0rc6+gitr3748_96ec2177ae84-11.1 docker-runc-debuginfo-1.0.0rc6+gitr3748_96ec2177ae84-11.1 docker-runc-debugsource-1.0.0rc6+gitr3748_96ec2177ae84-11.1 docker-runc-kubic-1.0.0rc6+gitr3748_96ec2177ae84-11.1 docker-runc-kubic-debuginfo-1.0.0rc6+gitr3748_96ec2177ae84-11.1 docker-runc-kubic-debugsource-1.0.0rc6+gitr3748_96ec2177ae84-11.1 golang-github-docker-libnetwork-0.7.0.1+gitr2711_2cfbf9b1f981-11.1 golang-github-docker-libnetwork-debugsource-0.7.0.1+gitr2711_2cfbf9b1f981-11.1 golang-github-docker-libnetwork-kubic-0.7.0.1+gitr2711_2cfbf9b1f981-11.1 golang-github-docker-libnetwork-kubic-debugsource-0.7.0.1+gitr2711_2cfbf9b1f981-11.1 - openSUSE Leap 42.3 (noarch): containerd-kubic-test-1.2.2-22.1 containerd-test-1.2.2-22.1 docker-bash-completion-18.09.1_ce-54.1 docker-kubic-bash-completion-18.09.1_ce-54.1 docker-kubic-zsh-completion-18.09.1_ce-54.1 docker-runc-kubic-test-1.0.0rc6+gitr3748_96ec2177ae84-11.1 docker-runc-test-1.0.0rc6+gitr3748_96ec2177ae84-11.1 docker-zsh-completion-18.09.1_ce-54.1 - openSUSE Leap 42.3 (x86_64): docker-18.09.1_ce-54.1 docker-debuginfo-18.09.1_ce-54.1 docker-debugsource-18.09.1_ce-54.1 docker-kubic-18.09.1_ce-54.1 docker-kubic-debuginfo-18.09.1_ce-54.1 docker-kubic-debugsource-18.09.1_ce-54.1 docker-kubic-kubeadm-criconfig-18.09.1_ce-54.1 docker-kubic-test-18.09.1_ce-54.1 docker-kubic-test-debuginfo-18.09.1_ce-54.1 docker-test-18.09.1_ce-54.1 docker-test-debuginfo-18.09.1_ce-54.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://www.suse.com/security/cve/CVE-2019-5736.html https://bugzilla.suse.com/1001161 https://bugzilla.suse.com/1048046 https://bugzilla.suse.com/1051429 https://bugzilla.suse.com/1112980 https://bugzilla.suse.com/1114832 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899 https://bugzilla.suse.com/1121412 https://bugzilla.suse.com/1121967 https://bugzilla.suse.com/1124308 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1077-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 29 Mar '19

29 Mar '19

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1077-1 Rating: important References: #1129821 #1130262 Cross-References: CVE-2018-18506 CVE-2019-9788 CVE-2019-9790 CVE-2019-9791 CVE-2019-9792 CVE-2019-9793 CVE-2019-9794 CVE-2019-9795 CVE-2019-9796 CVE-2019-9810 CVE-2019-9813 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Mozilla Firefox was updated to 60.6.1esr / MFSA 2019-10 (bsc#1130262) * CVE-2019-9810: IonMonkey MArraySlice has incorrect alias information * CVE-2019-9813: Ionmonkey type confusion with __proto__ mutations Mozilla Firefox was updated to 60.6.0esr / MFSA 2019-08 (boo#1129821) * CVE-2019-9790: Use-after-free when removing in-use DOM elements * CVE-2019-9791: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey * CVE-2019-9792: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script * CVE-2019-9793: Improper bounds checks when Spectre mitigations are disabled * CVE-2019-9794: Command line arguments not discarded during execution * CVE-2019-9795: Type-confusion in IonMonkey JIT compiler * CVE-2019-9796: Use-after-free with SMIL animation controller * CVE-2018-18506: Proxy Auto-Configuration file can define localhost access to be proxied * CVE-2019-9788: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 Mozilla Firefox 60.5.2esr also had one change: * Fix a frequent crash when reading various Reuters news articles. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1077=1 Package List: - openSUSE Leap 15.0 (x86_64): MozillaFirefox-60.6.1-lp150.3.45.1 MozillaFirefox-branding-upstream-60.6.1-lp150.3.45.1 MozillaFirefox-buildsymbols-60.6.1-lp150.3.45.1 MozillaFirefox-debuginfo-60.6.1-lp150.3.45.1 MozillaFirefox-debugsource-60.6.1-lp150.3.45.1 MozillaFirefox-devel-60.6.1-lp150.3.45.1 MozillaFirefox-translations-common-60.6.1-lp150.3.45.1 MozillaFirefox-translations-other-60.6.1-lp150.3.45.1 References: https://www.suse.com/security/cve/CVE-2018-18506.html https://www.suse.com/security/cve/CVE-2019-9788.html https://www.suse.com/security/cve/CVE-2019-9790.html https://www.suse.com/security/cve/CVE-2019-9791.html https://www.suse.com/security/cve/CVE-2019-9792.html https://www.suse.com/security/cve/CVE-2019-9793.html https://www.suse.com/security/cve/CVE-2019-9794.html https://www.suse.com/security/cve/CVE-2019-9795.html https://www.suse.com/security/cve/CVE-2019-9796.html https://www.suse.com/security/cve/CVE-2019-9810.html https://www.suse.com/security/cve/CVE-2019-9813.html https://bugzilla.suse.com/1129821 https://bugzilla.suse.com/1130262 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1074-1: important: Security update for qemu
by opensuse-security＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1074-1 Rating: important References: #1056334 #1056386 #1084604 #1113231 #1114957 #1116717 #1117275 #1119493 #1121600 #1123156 Cross-References: CVE-2017-13672 CVE-2017-13673 CVE-2018-16872 CVE-2018-18954 CVE-2018-19364 CVE-2018-19489 CVE-2018-7858 CVE-2019-6778 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has two fixes is now available. Description: This update for qemu fixes the following issues: Security vulnerabilities addressed: - CVE-2019-6778: Fixed an out-of-bounds access in slirp (bsc#1123156) - CVE-2018-16872: Fixed a host security vulnerability related to handling symlinks in usb-mtp (bsc#1119493) - CVE-2018-19489: Fixed a Denial-of-Service in virtfs (bsc#1117275) - CVE-2018-19364: Fixed an use-after-free vulnerability if virtfs interface is deliberately abused (bsc#1116717) - CVE-2018-18954: Fixed an out-of-bounds access performing PowerNV memory operations (bsc#1114957) - CVE-2017-13673: Fixed a reachable assert failure during during display update (bsc#1056386) - CVE-2017-13672: Fixed an out-of-bounds read access during display update (bsc#1056334) - CVE-2018-7858: Fixed an out-of-bounds access in cirrus when updating vga display allowing for Denial-of-Service (bsc#1084604) Other bug fixes and changes: - Fix pwrite64/pread64/write to return 0 over -1 for a zero length NULL buffer in qemu (bsc#1121600) - Fix bad guest time after migration (bsc#1113231) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1074=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): qemu-linux-user-2.9.1-56.1 qemu-linux-user-debuginfo-2.9.1-56.1 qemu-linux-user-debugsource-2.9.1-56.1 - openSUSE Leap 42.3 (noarch): qemu-ipxe-1.0.0+-56.1 qemu-seabios-1.10.2-56.1 qemu-sgabios-8-56.1 qemu-vgabios-1.10.2-56.1 - openSUSE Leap 42.3 (x86_64): qemu-2.9.1-56.1 qemu-arm-2.9.1-56.1 qemu-arm-debuginfo-2.9.1-56.1 qemu-block-curl-2.9.1-56.1 qemu-block-curl-debuginfo-2.9.1-56.1 qemu-block-dmg-2.9.1-56.1 qemu-block-dmg-debuginfo-2.9.1-56.1 qemu-block-iscsi-2.9.1-56.1 qemu-block-iscsi-debuginfo-2.9.1-56.1 qemu-block-rbd-2.9.1-56.1 qemu-block-rbd-debuginfo-2.9.1-56.1 qemu-block-ssh-2.9.1-56.1 qemu-block-ssh-debuginfo-2.9.1-56.1 qemu-debugsource-2.9.1-56.1 qemu-extra-2.9.1-56.1 qemu-extra-debuginfo-2.9.1-56.1 qemu-guest-agent-2.9.1-56.1 qemu-guest-agent-debuginfo-2.9.1-56.1 qemu-ksm-2.9.1-56.1 qemu-kvm-2.9.1-56.1 qemu-lang-2.9.1-56.1 qemu-ppc-2.9.1-56.1 qemu-ppc-debuginfo-2.9.1-56.1 qemu-s390-2.9.1-56.1 qemu-s390-debuginfo-2.9.1-56.1 qemu-testsuite-2.9.1-56.2 qemu-tools-2.9.1-56.1 qemu-tools-debuginfo-2.9.1-56.1 qemu-x86-2.9.1-56.1 qemu-x86-debuginfo-2.9.1-56.1 References: https://www.suse.com/security/cve/CVE-2017-13672.html https://www.suse.com/security/cve/CVE-2017-13673.html https://www.suse.com/security/cve/CVE-2018-16872.html https://www.suse.com/security/cve/CVE-2018-18954.html https://www.suse.com/security/cve/CVE-2018-19364.html https://www.suse.com/security/cve/CVE-2018-19489.html https://www.suse.com/security/cve/CVE-2018-7858.html https://www.suse.com/security/cve/CVE-2019-6778.html https://bugzilla.suse.com/1056334 https://bugzilla.suse.com/1056386 https://bugzilla.suse.com/1084604 https://bugzilla.suse.com/1113231 https://bugzilla.suse.com/1114957 https://bugzilla.suse.com/1116717 https://bugzilla.suse.com/1117275 https://bugzilla.suse.com/1119493 https://bugzilla.suse.com/1121600 https://bugzilla.suse.com/1123156 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1076-1: moderate: Security update for nodejs4
by opensuse-security＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Security Update: Security update for nodejs4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1076-1 Rating: moderate References: #1127080 #1127532 #1127533 Cross-References: CVE-2019-1559 CVE-2019-5737 CVE-2019-5739 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nodejs4 fixes the following issues: Security issues fixed: - CVE-2019-5739: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127533). - CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127532). - CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding Oracle which under certain circumstances a TLS server can be forced to respond differently to a client and lead to the decryption of the data (bsc#1127080). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1076=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): nodejs4-4.9.1-23.1 nodejs4-debuginfo-4.9.1-23.1 nodejs4-debugsource-4.9.1-23.1 nodejs4-devel-4.9.1-23.1 npm4-4.9.1-23.1 - openSUSE Leap 42.3 (noarch): nodejs4-docs-4.9.1-23.1 References: https://www.suse.com/security/cve/CVE-2019-1559.html https://www.suse.com/security/cve/CVE-2019-5737.html https://www.suse.com/security/cve/CVE-2019-5739.html https://bugzilla.suse.com/1127080 https://bugzilla.suse.com/1127532 https://bugzilla.suse.com/1127533 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1075-1: moderate: Security update for libssh2_org
by opensuse-security＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Security Update: Security update for libssh2_org ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1075-1 Rating: moderate References: #1091236 #1128471 #1128472 #1128474 #1128476 #1128480 #1128481 #1128490 #1128492 #1128493 Cross-References: CVE-2019-3855 CVE-2019-3856 CVE-2019-3857 CVE-2019-3858 CVE-2019-3859 CVE-2019-3860 CVE-2019-3861 CVE-2019-3862 CVE-2019-3863 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 9 vulnerabilities and has one errata is now available. Description: This update for libssh2_org fixes the following issues: Security issues fixed: - CVE-2019-3861: Fixed Out-of-bounds reads with specially crafted SSH packets (bsc#1128490). - CVE-2019-3862: Fixed Out-of-bounds memory comparison with specially crafted message channel request packet (bsc#1128492). - CVE-2019-3860: Fixed Out-of-bounds reads with specially crafted SFTP packets (bsc#1128481). - CVE-2019-3863: Fixed an Integer overflow in user authenticate keyboard interactive which could allow out-of-bounds writes with specially crafted keyboard responses (bsc#1128493). - CVE-2019-3856: Fixed a potential Integer overflow in keyboard interactive handling which could allow out-of-bounds write with specially crafted payload (bsc#1128472). - CVE-2019-3859: Fixed Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev (bsc#1128480). - CVE-2019-3855: Fixed a potential Integer overflow in transport read which could allow out-of-bounds write with specially crafted payload (bsc#1128471). - CVE-2019-3858: Fixed a potential zero-byte allocation which could lead to an out-of-bounds read with a specially crafted SFTP packet (bsc#1128476). - CVE-2019-3857: Fixed a potential Integer overflow which could lead to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet (bsc#1128474). Other issue addressed: - Libbssh2 will stop using keys unsupported types in the known_hosts file (bsc#1091236). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1075=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libssh2-1-1.4.3-19.3.1 libssh2-1-debuginfo-1.4.3-19.3.1 libssh2-devel-1.4.3-19.3.1 libssh2_org-debugsource-1.4.3-19.3.1 - openSUSE Leap 42.3 (x86_64): libssh2-1-32bit-1.4.3-19.3.1 libssh2-1-debuginfo-32bit-1.4.3-19.3.1 References: https://www.suse.com/security/cve/CVE-2019-3855.html https://www.suse.com/security/cve/CVE-2019-3856.html https://www.suse.com/security/cve/CVE-2019-3857.html https://www.suse.com/security/cve/CVE-2019-3858.html https://www.suse.com/security/cve/CVE-2019-3859.html https://www.suse.com/security/cve/CVE-2019-3860.html https://www.suse.com/security/cve/CVE-2019-3861.html https://www.suse.com/security/cve/CVE-2019-3862.html https://www.suse.com/security/cve/CVE-2019-3863.html https://bugzilla.suse.com/1091236 https://bugzilla.suse.com/1128471 https://bugzilla.suse.com/1128472 https://bugzilla.suse.com/1128474 https://bugzilla.suse.com/1128476 https://bugzilla.suse.com/1128480 https://bugzilla.suse.com/1128481 https://bugzilla.suse.com/1128490 https://bugzilla.suse.com/1128492 https://bugzilla.suse.com/1128493 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1066-1: Security update for ffmpeg-4
by opensuse-security＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Security Update: Security update for ffmpeg-4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1066-1 Rating: low References: #1092241 #1100348 #1105869 Cross-References: CVE-2018-13300 CVE-2018-15822 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for ffmpeg-4 to version 4.0.2 fixes the following issues: These security issues were fixed: - CVE-2018-15822: The flv_write_packet function did not check for an empty audio packet, leading to an assertion failure and DoS (bsc#1105869). - CVE-2018-13300: An improper argument passed to the avpriv_request_sample function may have triggered an out-of-array read while converting a crafted AVI file to MPEG4, leading to a denial of service and possibly an information disclosure (bsc#1100348). These non-security issues were fixed: - Enable webvtt encoders and decoders (boo#1092241). - Build codec2 encoder and decoder, add libcodec2 to enable_decoders and enable_encoders. - Enable mpeg 1 and 2 encoders. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1066=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): ffmpeg-4-libavcodec-devel-4.0.2-bp150.21.1 ffmpeg-4-libavdevice-devel-4.0.2-bp150.21.1 ffmpeg-4-libavfilter-devel-4.0.2-bp150.21.1 ffmpeg-4-libavformat-devel-4.0.2-bp150.21.1 ffmpeg-4-libavresample-devel-4.0.2-bp150.21.1 ffmpeg-4-libavutil-devel-4.0.2-bp150.21.1 ffmpeg-4-libpostproc-devel-4.0.2-bp150.21.1 ffmpeg-4-libswresample-devel-4.0.2-bp150.21.1 ffmpeg-4-libswscale-devel-4.0.2-bp150.21.1 ffmpeg-4-private-devel-4.0.2-bp150.21.1 libavcodec58-4.0.2-bp150.21.1 libavdevice58-4.0.2-bp150.21.1 libavfilter7-4.0.2-bp150.21.1 libavformat58-4.0.2-bp150.21.1 libavresample4-4.0.2-bp150.21.1 libavutil56-4.0.2-bp150.21.1 libpostproc55-4.0.2-bp150.21.1 libswresample3-4.0.2-bp150.21.1 libswscale5-4.0.2-bp150.21.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libavcodec58-64bit-4.0.2-bp150.21.1 libavdevice58-64bit-4.0.2-bp150.21.1 libavfilter7-64bit-4.0.2-bp150.21.1 libavformat58-64bit-4.0.2-bp150.21.1 libavresample4-64bit-4.0.2-bp150.21.1 libavutil56-64bit-4.0.2-bp150.21.1 libpostproc55-64bit-4.0.2-bp150.21.1 libswresample3-64bit-4.0.2-bp150.21.1 libswscale5-64bit-4.0.2-bp150.21.1 References: https://www.suse.com/security/cve/CVE-2018-13300.html https://www.suse.com/security/cve/CVE-2018-15822.html https://bugzilla.suse.com/1092241 https://bugzilla.suse.com/1100348 https://bugzilla.suse.com/1105869 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1062-1: important: Security update for chromium
by opensuse-security＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1062-1 Rating: important References: #1129059 Cross-References: CVE-2019-5787 CVE-2019-5788 CVE-2019-5789 CVE-2019-5790 CVE-2019-5791 CVE-2019-5792 CVE-2019-5793 CVE-2019-5794 CVE-2019-5795 CVE-2019-5796 CVE-2019-5797 CVE-2019-5798 CVE-2019-5799 CVE-2019-5800 CVE-2019-5801 CVE-2019-5802 CVE-2019-5803 CVE-2019-5804 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: This update for chromium to version 73.0.3683.75 fixes the following issues: Security issues fixed (bsc#1129059): - CVE-2019-5787: Fixed a use after free in Canvas. - CVE-2019-5788: Fixed a use after free in FileAPI. - CVE-2019-5789: Fixed a use after free in WebMIDI. - CVE-2019-5790: Fixed a heap buffer overflow in V8. - CVE-2019-5791: Fixed a type confusion in V8. - CVE-2019-5792: Fixed an integer overflow in PDFium. - CVE-2019-5793: Fixed excessive permissions for private API in Extensions. - CVE-2019-5794: Fixed security UI spoofing. - CVE-2019-5795: Fixed an integer overflow in PDFium. - CVE-2019-5796: Fixed a race condition in Extensions. - CVE-2019-5797: Fixed a race condition in DOMStorage. - CVE-2019-5798: Fixed an out of bounds read in Skia. - CVE-2019-5799: Fixed a CSP bypass with blob URL. - CVE-2019-5800: Fixed a CSP bypass with blob URL. - CVE-2019-5801: Fixed an incorrect Omnibox display on iOS. - CVE-2019-5802: Fixed security UI spoofing. - CVE-2019-5803: Fixed a CSP bypass with Javascript URLs'. - CVE-2019-5804: Fixed a command line injection on Windows. Release notes: https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-des ktop_12.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1062=1 Package List: - openSUSE Leap 15.0 (x86_64): chromedriver-73.0.3683.75-lp150.206.1 chromedriver-debuginfo-73.0.3683.75-lp150.206.1 chromium-73.0.3683.75-lp150.206.1 chromium-debuginfo-73.0.3683.75-lp150.206.1 chromium-debugsource-73.0.3683.75-lp150.206.1 References: https://www.suse.com/security/cve/CVE-2019-5787.html https://www.suse.com/security/cve/CVE-2019-5788.html https://www.suse.com/security/cve/CVE-2019-5789.html https://www.suse.com/security/cve/CVE-2019-5790.html https://www.suse.com/security/cve/CVE-2019-5791.html https://www.suse.com/security/cve/CVE-2019-5792.html https://www.suse.com/security/cve/CVE-2019-5793.html https://www.suse.com/security/cve/CVE-2019-5794.html https://www.suse.com/security/cve/CVE-2019-5795.html https://www.suse.com/security/cve/CVE-2019-5796.html https://www.suse.com/security/cve/CVE-2019-5797.html https://www.suse.com/security/cve/CVE-2019-5798.html https://www.suse.com/security/cve/CVE-2019-5799.html https://www.suse.com/security/cve/CVE-2019-5800.html https://www.suse.com/security/cve/CVE-2019-5801.html https://www.suse.com/security/cve/CVE-2019-5802.html https://www.suse.com/security/cve/CVE-2019-5803.html https://www.suse.com/security/cve/CVE-2019-5804.html https://bugzilla.suse.com/1129059 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1058-1: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1058-1 Rating: low References: #1128649 Cross-References: CVE-2019-7175 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issue: Security issues fixed: - CVE-2019-7175: Fixed multiple memory leaks in DecodeImage function (bsc#1128649). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1058=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-129.1 GraphicsMagick-debuginfo-1.3.25-129.1 GraphicsMagick-debugsource-1.3.25-129.1 GraphicsMagick-devel-1.3.25-129.1 libGraphicsMagick++-Q16-12-1.3.25-129.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-129.1 libGraphicsMagick++-devel-1.3.25-129.1 libGraphicsMagick-Q16-3-1.3.25-129.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-129.1 libGraphicsMagick3-config-1.3.25-129.1 libGraphicsMagickWand-Q16-2-1.3.25-129.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-129.1 perl-GraphicsMagick-1.3.25-129.1 perl-GraphicsMagick-debuginfo-1.3.25-129.1 References: https://www.suse.com/security/cve/CVE-2019-7175.html https://bugzilla.suse.com/1128649 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1059-1: moderate: Security update for lftp
by opensuse-security＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Security Update: Security update for lftp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1059-1 Rating: moderate References: #1103367 #1120946 Cross-References: CVE-2018-10916 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for lftp fixes the following issues: Security issue fixed: - CVE-2018-10916: Fixed an improper file name sanitization which could lead to loss of integrity of the local system (bsc#1103367). Other issue addressed: - The SSH login handling code detects password prompts more reliably (bsc#1120946). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1059=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): lftp-4.7.4-2.6.1 lftp-debuginfo-4.7.4-2.6.1 lftp-debugsource-4.7.4-2.6.1 References: https://www.suse.com/security/cve/CVE-2018-10916.html https://bugzilla.suse.com/1103367 https://bugzilla.suse.com/1120946 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1056-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 27 Mar '19

27 Mar '19

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1056-1 Rating: important References: #1129821 #1130262 Cross-References: CVE-2018-18506 CVE-2019-9788 CVE-2019-9790 CVE-2019-9791 CVE-2019-9792 CVE-2019-9793 CVE-2019-9794 CVE-2019-9795 CVE-2019-9796 CVE-2019-9810 CVE-2019-9813 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Mozilla Firefox was updated to 60.6.1esr (MFSA 2019-10 boo#1130262) * CVE-2019-9810: IonMonkey MArraySlice has incorrect alias information * CVE-2019-9813: Ionmonkey type confusion with __proto__ mutations Mozilla Firefox was updated to 60.6.0esr (MFSA 2019-08 boo#1129821) * CVE-2019-9790: Use-after-free when removing in-use DOM elements * CVE-2019-9791: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey * CVE-2019-9792: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script * CVE-2019-9793: Improper bounds checks when Spectre mitigations are disabled * CVE-2019-9794: Command line arguments not discarded during execution * CVE-2019-9795: Type-confusion in IonMonkey JIT compiler * CVE-2019-9796: Use-after-free with SMIL animation controller * CVE-2018-18506: Proxy Auto-Configuration file can define localhost access to be proxied * CVE-2019-9788: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 Mozilla Firefox was updated to 60.5.2esr: * Fix a frequent crash when reading various Reuters news articles Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1056=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-60.6.1-135.1 MozillaFirefox-branding-upstream-60.6.1-135.1 MozillaFirefox-buildsymbols-60.6.1-135.1 MozillaFirefox-debuginfo-60.6.1-135.1 MozillaFirefox-debugsource-60.6.1-135.1 MozillaFirefox-devel-60.6.1-135.1 MozillaFirefox-translations-common-60.6.1-135.1 MozillaFirefox-translations-other-60.6.1-135.1 References: https://www.suse.com/security/cve/CVE-2018-18506.html https://www.suse.com/security/cve/CVE-2019-9788.html https://www.suse.com/security/cve/CVE-2019-9790.html https://www.suse.com/security/cve/CVE-2019-9791.html https://www.suse.com/security/cve/CVE-2019-9792.html https://www.suse.com/security/cve/CVE-2019-9793.html https://www.suse.com/security/cve/CVE-2019-9794.html https://www.suse.com/security/cve/CVE-2019-9795.html https://www.suse.com/security/cve/CVE-2019-9796.html https://www.suse.com/security/cve/CVE-2019-9810.html https://www.suse.com/security/cve/CVE-2019-9813.html https://bugzilla.suse.com/1129821 https://bugzilla.suse.com/1130262 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1049-1: moderate: Security update for aubio
by opensuse-security＠opensuse.org 25 Mar '19

25 Mar '19

openSUSE Security Update: Security update for aubio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1049-1 Rating: moderate References: #1102359 #1102364 Cross-References: CVE-2018-14522 CVE-2018-14523 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for aubio fixes the following issues: - CVE-2018-14522: Fixed a crash in aubio_pitch_set_unit (bsc#1102359) - CVE-2018-14523: Fixed a buffer overrread resulting in crash or information leakage in new_aubio_pitchyinfft (bsc#1102364) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1049=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): aubio-debugsource-0.4.1-bp150.3.6.1 aubio-tools-0.4.1-bp150.3.6.1 aubio-tools-debuginfo-0.4.1-bp150.3.6.1 libaubio-devel-0.4.1-bp150.3.6.1 libaubio4-0.4.1-bp150.3.6.1 libaubio4-debuginfo-0.4.1-bp150.3.6.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libaubio4-64bit-0.4.1-bp150.3.6.1 libaubio4-64bit-debuginfo-0.4.1-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-14522.html https://www.suse.com/security/cve/CVE-2018-14523.html https://bugzilla.suse.com/1102359 https://bugzilla.suse.com/1102364 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1050-1: moderate: Security update for blueman
by opensuse-security＠opensuse.org 25 Mar '19

25 Mar '19

openSUSE Security Update: Security update for blueman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1050-1 Rating: moderate References: #1083066 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for blueman fixes the following issues: The following security issue was addressed: - Fixed the polkit authorization checks in blueman, which previously allowed any user with access to the D-Bus system bus to trigger certain network configuration logic in blueman without authentication (boo#1083066). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1050=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): blueman-2.0.6-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): blueman-lang-2.0.6-bp150.2.3.1 thunar-sendto-blueman-2.0.6-bp150.2.3.1 References: https://bugzilla.suse.com/1083066 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1050-1: moderate: Security update for blueman
by opensuse-security＠opensuse.org 25 Mar '19

25 Mar '19

openSUSE Security Update: Security update for blueman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1050-1 Rating: moderate References: #1083066 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for blueman fixes the following issues: The following security issue was addressed: - Fixed the polkit authorization checks in blueman, which previously allowed any user with access to the D-Bus system bus to trigger certain network configuration logic in blueman without authentication (boo#1083066). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1050=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): blueman-2.0.6-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): blueman-lang-2.0.6-bp150.2.3.1 thunar-sendto-blueman-2.0.6-bp150.2.3.1 References: https://bugzilla.suse.com/1083066 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1049-1: moderate: Security update for aubio
by opensuse-security＠opensuse.org 25 Mar '19

25 Mar '19

openSUSE Security Update: Security update for aubio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1049-1 Rating: moderate References: #1102359 #1102364 Cross-References: CVE-2018-14522 CVE-2018-14523 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for aubio fixes the following issues: - CVE-2018-14522: Fixed a crash in aubio_pitch_set_unit (bsc#1102359) - CVE-2018-14523: Fixed a buffer overrread resulting in crash or information leakage in new_aubio_pitchyinfft (bsc#1102364) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1049=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): aubio-debugsource-0.4.1-bp150.3.6.1 aubio-tools-0.4.1-bp150.3.6.1 aubio-tools-debuginfo-0.4.1-bp150.3.6.1 libaubio-devel-0.4.1-bp150.3.6.1 libaubio4-0.4.1-bp150.3.6.1 libaubio4-debuginfo-0.4.1-bp150.3.6.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libaubio4-64bit-0.4.1-bp150.3.6.1 libaubio4-64bit-debuginfo-0.4.1-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-14522.html https://www.suse.com/security/cve/CVE-2018-14523.html https://bugzilla.suse.com/1102359 https://bugzilla.suse.com/1102364 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1051-1: moderate: Security update for kauth
by opensuse-security＠opensuse.org 25 Mar '19

25 Mar '19

openSUSE Security Update: Security update for kauth ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1051-1 Rating: moderate References: #1124863 Cross-References: CVE-2019-7443 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kauth fixes the following issues: Security issue fixed: - CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants (bsc#1124863). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1051=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): kauth-debugsource-5.32.0-bp150.3.10.1 kauth-devel-5.32.0-bp150.3.10.1 kcoreaddons-5.32.0-bp150.3.3.1 kcoreaddons-debugsource-5.32.0-bp150.3.3.1 kcoreaddons-devel-5.32.0-bp150.3.3.1 kcoreaddons-devel-debuginfo-5.32.0-bp150.3.3.1 libKF5Auth5-5.32.0-bp150.3.10.1 libKF5Auth5-debuginfo-5.32.0-bp150.3.10.1 libKF5CoreAddons5-5.32.0-bp150.3.3.1 libKF5CoreAddons5-debuginfo-5.32.0-bp150.3.3.1 libpolkit-qt5-1-1-0.112.0-bp150.3.3.1 libpolkit-qt5-1-devel-0.112.0-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): kauth-devel-64bit-5.32.0-bp150.3.10.1 kcoreaddons-devel-64bit-5.32.0-bp150.3.3.1 kcoreaddons-devel-64bit-debuginfo-5.32.0-bp150.3.3.1 libKF5Auth5-64bit-5.32.0-bp150.3.10.1 libKF5Auth5-64bit-debuginfo-5.32.0-bp150.3.10.1 libKF5CoreAddons5-64bit-5.32.0-bp150.3.3.1 libKF5CoreAddons5-64bit-debuginfo-5.32.0-bp150.3.3.1 libpolkit-qt5-1-1-64bit-0.112.0-bp150.3.3.1 libpolkit-qt5-1-devel-64bit-0.112.0-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): kcoreaddons-lang-5.32.0-bp150.3.3.1 libKF5Auth5-lang-5.32.0-bp150.3.10.1 References: https://www.suse.com/security/cve/CVE-2019-7443.html https://bugzilla.suse.com/1124863 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0348-1: important: Security update for ovmf
by opensuse-security＠opensuse.org 19 Mar '19

19 Mar '19

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0348-1 Rating: important References: #1127820 #1127821 #1127822 Cross-References: CVE-2018-12178 CVE-2018-12180 CVE-2018-3630 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for ovmf fixes the following issues: Security issues fixed: - CVE-2018-12180: Fixed a buffer overflow in BlockIo service, which could lead to memory read/write overrun (bsc#1127820). - CVE-2018-12178: Fixed an improper DNS check upon receiving a new DNS packet (bsc#1127821). - CVE-2018-3630: Fixed a logic error in FV parsing which could allow a local attacker to bypass the chain of trust checks (bsc#1127822). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-348=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ovmf-2017+git1492060560.b6d11d7c46-16.1 ovmf-tools-2017+git1492060560.b6d11d7c46-16.1 - openSUSE Leap 42.3 (x86_64): qemu-ovmf-x86_64-debug-2017+git1492060560.b6d11d7c46-16.1 - openSUSE Leap 42.3 (noarch): qemu-ovmf-ia32-2017+git1492060560.b6d11d7c46-16.1 qemu-ovmf-x86_64-2017+git1492060560.b6d11d7c46-16.1 References: https://www.suse.com/security/cve/CVE-2018-12178.html https://www.suse.com/security/cve/CVE-2018-12180.html https://www.suse.com/security/cve/CVE-2018-3630.html https://bugzilla.suse.com/1127820 https://bugzilla.suse.com/1127821 https://bugzilla.suse.com/1127822 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0346-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 18 Mar '19

18 Mar '19

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0346-1 Rating: important References: #1122293 #1122299 Cross-References: CVE-2018-11212 CVE-2019-2422 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for java-1_8_0-openjdk to version jdk8u201 (icedtea 3.11.0) fixes the following issues: Security issues fixed: - CVE-2019-2422: Fixed a memory disclosure in FileChannelImpl (bsc#1122293). - CVE-2018-11212: Fixed an issue in alloc_sarray function in jmemmgr.c (bsc#1122299). Complete list of changes: https://mail.openjdk.java.net/pipermail/distro-pkg-dev/2019-March/041223.ht ml This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-346=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): java-1_8_0-openjdk-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-accessibility-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-debuginfo-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-debugsource-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-demo-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-devel-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-headless-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.201-lp150.2.12.1 java-1_8_0-openjdk-src-1.8.0.201-lp150.2.12.1 - openSUSE Leap 15.0 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.201-lp150.2.12.1 References: https://www.suse.com/security/cve/CVE-2018-11212.html https://www.suse.com/security/cve/CVE-2019-2422.html https://bugzilla.suse.com/1122293 https://bugzilla.suse.com/1122299 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0345-1: moderate: Security update for file
by opensuse-security＠opensuse.org 18 Mar '19

18 Mar '19

openSUSE Security Update: Security update for file ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0345-1 Rating: moderate References: #1096974 #1096984 #1126117 #1126118 #1126119 Cross-References: CVE-2018-10360 CVE-2019-8905 CVE-2019-8906 CVE-2019-8907 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for file fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-10360: Fixed an out-of-bounds read in the function do_core_note in readelf.c, which allowed remote attackers to cause a denial of service (application crash) via a crafted ELF file (bsc#1096974) - CVE-2019-8905: Fixed a stack-based buffer over-read in do_core_note in readelf.c (bsc#1126118) - CVE-2019-8906: Fixed an out-of-bounds read in do_core_note in readelf. c (bsc#1126119) - CVE-2019-8907: Fixed a stack corruption in do_core_note in readelf.c (bsc#1126117) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-345=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): file-5.32-lp150.6.3.1 file-debuginfo-5.32-lp150.6.3.1 file-debugsource-5.32-lp150.6.3.1 file-devel-5.32-lp150.6.3.1 libmagic1-5.32-lp150.6.3.1 libmagic1-debuginfo-5.32-lp150.6.3.1 python2-magic-5.32-lp150.6.3.1 python3-magic-5.32-lp150.6.3.1 - openSUSE Leap 15.0 (x86_64): file-devel-32bit-5.32-lp150.6.3.1 libmagic1-32bit-5.32-lp150.6.3.1 libmagic1-32bit-debuginfo-5.32-lp150.6.3.1 - openSUSE Leap 15.0 (noarch): file-magic-5.32-lp150.6.3.1 References: https://www.suse.com/security/cve/CVE-2018-10360.html https://www.suse.com/security/cve/CVE-2019-8905.html https://www.suse.com/security/cve/CVE-2019-8906.html https://www.suse.com/security/cve/CVE-2019-8907.html https://bugzilla.suse.com/1096974 https://bugzilla.suse.com/1096984 https://bugzilla.suse.com/1126117 https://bugzilla.suse.com/1126118 https://bugzilla.suse.com/1126119 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0344-1: moderate: Security update for sssd
by opensuse-security＠opensuse.org 18 Mar '19

18 Mar '19

openSUSE Security Update: Security update for sssd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0344-1 Rating: moderate References: #1004220 #1087320 #1120852 #1121759 #1125277 Cross-References: CVE-2019-3811 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has four fixes is now available. Description: This update for sssd fixes the following issues: Security vulnerability addresed: - CVE-2019-3811: Fix fallback_homedir returning '/' for empty home directories (bsc#1121759) Other bug fixes and changes: - Install logrotate configuration (bsc#1004220) - Align systemd service file with upstream, run interactive and change service type to notify (bsc#1120852) - Fix sssd not starting in foreground mode (bsc#1125277) - Strip whitespaces in netgroup triples (bsc#1087320) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-344=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): adcli-0.8.2-lp150.4.1 adcli-debuginfo-0.8.2-lp150.4.1 adcli-debugsource-0.8.2-lp150.4.1 adcli-doc-0.8.2-lp150.4.1 libipa_hbac-devel-1.16.1-lp150.2.9.1 libipa_hbac0-1.16.1-lp150.2.9.1 libipa_hbac0-debuginfo-1.16.1-lp150.2.9.1 libnfsidmap-sss-1.16.1-lp150.2.9.1 libnfsidmap-sss-debuginfo-1.16.1-lp150.2.9.1 libsss_certmap-devel-1.16.1-lp150.2.9.1 libsss_certmap0-1.16.1-lp150.2.9.1 libsss_certmap0-debuginfo-1.16.1-lp150.2.9.1 libsss_idmap-devel-1.16.1-lp150.2.9.1 libsss_idmap0-1.16.1-lp150.2.9.1 libsss_idmap0-debuginfo-1.16.1-lp150.2.9.1 libsss_nss_idmap-devel-1.16.1-lp150.2.9.1 libsss_nss_idmap0-1.16.1-lp150.2.9.1 libsss_nss_idmap0-debuginfo-1.16.1-lp150.2.9.1 libsss_simpleifp-devel-1.16.1-lp150.2.9.1 libsss_simpleifp0-1.16.1-lp150.2.9.1 libsss_simpleifp0-debuginfo-1.16.1-lp150.2.9.1 python3-ipa_hbac-1.16.1-lp150.2.9.1 python3-ipa_hbac-debuginfo-1.16.1-lp150.2.9.1 python3-sss-murmur-1.16.1-lp150.2.9.1 python3-sss-murmur-debuginfo-1.16.1-lp150.2.9.1 python3-sss_nss_idmap-1.16.1-lp150.2.9.1 python3-sss_nss_idmap-debuginfo-1.16.1-lp150.2.9.1 python3-sssd-config-1.16.1-lp150.2.9.1 python3-sssd-config-debuginfo-1.16.1-lp150.2.9.1 sssd-1.16.1-lp150.2.9.1 sssd-ad-1.16.1-lp150.2.9.1 sssd-ad-debuginfo-1.16.1-lp150.2.9.1 sssd-dbus-1.16.1-lp150.2.9.1 sssd-dbus-debuginfo-1.16.1-lp150.2.9.1 sssd-debuginfo-1.16.1-lp150.2.9.1 sssd-debugsource-1.16.1-lp150.2.9.1 sssd-ipa-1.16.1-lp150.2.9.1 sssd-ipa-debuginfo-1.16.1-lp150.2.9.1 sssd-krb5-1.16.1-lp150.2.9.1 sssd-krb5-common-1.16.1-lp150.2.9.1 sssd-krb5-common-debuginfo-1.16.1-lp150.2.9.1 sssd-krb5-debuginfo-1.16.1-lp150.2.9.1 sssd-ldap-1.16.1-lp150.2.9.1 sssd-ldap-debuginfo-1.16.1-lp150.2.9.1 sssd-proxy-1.16.1-lp150.2.9.1 sssd-proxy-debuginfo-1.16.1-lp150.2.9.1 sssd-tools-1.16.1-lp150.2.9.1 sssd-tools-debuginfo-1.16.1-lp150.2.9.1 sssd-wbclient-1.16.1-lp150.2.9.1 sssd-wbclient-debuginfo-1.16.1-lp150.2.9.1 sssd-wbclient-devel-1.16.1-lp150.2.9.1 sssd-winbind-idmap-1.16.1-lp150.2.9.1 sssd-winbind-idmap-debuginfo-1.16.1-lp150.2.9.1 - openSUSE Leap 15.0 (x86_64): sssd-32bit-1.16.1-lp150.2.9.1 sssd-32bit-debuginfo-1.16.1-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2019-3811.html https://bugzilla.suse.com/1004220 https://bugzilla.suse.com/1087320 https://bugzilla.suse.com/1120852 https://bugzilla.suse.com/1121759 https://bugzilla.suse.com/1125277 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0343-1: important: Security update for chromium
by opensuse-security＠opensuse.org 17 Mar '19

17 Mar '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0343-1 Rating: important References: #1129059 Cross-References: CVE-2019-5787 CVE-2019-5788 CVE-2019-5789 CVE-2019-5790 CVE-2019-5791 CVE-2019-5792 CVE-2019-5793 CVE-2019-5794 CVE-2019-5795 CVE-2019-5796 CVE-2019-5797 CVE-2019-5798 CVE-2019-5799 CVE-2019-5800 CVE-2019-5801 CVE-2019-5802 CVE-2019-5803 CVE-2019-5804 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: This update for chromium to version 73.0.3683.75 fixes the following issues: Security issues fixed (bsc#1129059): - CVE-2019-5787: Fixed a use after free in Canvas. - CVE-2019-5788: Fixed a use after free in FileAPI. - CVE-2019-5789: Fixed a use after free in WebMIDI. - CVE-2019-5790: Fixed a heap buffer overflow in V8. - CVE-2019-5791: Fixed a type confusion in V8. - CVE-2019-5792: Fixed an integer overflow in PDFium. - CVE-2019-5793: Fixed excessive permissions for private API in Extensions. - CVE-2019-5794: Fixed security UI spoofing. - CVE-2019-5795: Fixed an integer overflow in PDFium. - CVE-2019-5796: Fixed a race condition in Extensions. - CVE-2019-5797: Fixed a race condition in DOMStorage. - CVE-2019-5798: Fixed an out of bounds read in Skia. - CVE-2019-5799: Fixed a CSP bypass with blob URL. - CVE-2019-5800: Fixed a CSP bypass with blob URL. - CVE-2019-5801: Fixed an incorrect Omnibox display on iOS. - CVE-2019-5802: Fixed security UI spoofing. - CVE-2019-5803: Fixed a CSP bypass with Javascript URLs'. - CVE-2019-5804: Fixed a command line injection on Windows. Release notes: https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-des ktop_12.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-343=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-73.0.3683.75-205.1 chromedriver-debuginfo-73.0.3683.75-205.1 chromium-73.0.3683.75-205.1 chromium-debuginfo-73.0.3683.75-205.1 chromium-debugsource-73.0.3683.75-205.1 References: https://www.suse.com/security/cve/CVE-2019-5787.html https://www.suse.com/security/cve/CVE-2019-5788.html https://www.suse.com/security/cve/CVE-2019-5789.html https://www.suse.com/security/cve/CVE-2019-5790.html https://www.suse.com/security/cve/CVE-2019-5791.html https://www.suse.com/security/cve/CVE-2019-5792.html https://www.suse.com/security/cve/CVE-2019-5793.html https://www.suse.com/security/cve/CVE-2019-5794.html https://www.suse.com/security/cve/CVE-2019-5795.html https://www.suse.com/security/cve/CVE-2019-5796.html https://www.suse.com/security/cve/CVE-2019-5797.html https://www.suse.com/security/cve/CVE-2019-5798.html https://www.suse.com/security/cve/CVE-2019-5799.html https://www.suse.com/security/cve/CVE-2019-5800.html https://www.suse.com/security/cve/CVE-2019-5801.html https://www.suse.com/security/cve/CVE-2019-5802.html https://www.suse.com/security/cve/CVE-2019-5803.html https://www.suse.com/security/cve/CVE-2019-5804.html https://bugzilla.suse.com/1129059 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0329-1: important: Security update for obs-service-tar_scm
by opensuse-security＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Security Update: Security update for obs-service-tar_scm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0329-1 Rating: important References: #1076410 #1082696 #1105361 #1107507 #1107944 Cross-References: CVE-2018-12473 CVE-2018-12474 CVE-2018-12476 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for obs-service-tar_scm fixes the following issues: Security vulnerabilities addressed: - CVE-2018-12473: Fixed a path traversal issue, which allowed users to access files outside of the repository using relative paths (bsc#1105361) - CVE-2018-12474: Fixed an issue whereby crafted service parameters allowed for unexpected behaviour (bsc#1107507) - CVE-2018-12476: Fixed an issue whereby the outfilename parameter allowed to write files outside of package directory (bsc#1107944) Other bug fixes and changes made: - Prefer UTF-8 locale as output format for changes - added KankuFile - fix problems with unicode source files - added python-six to Requires in specfile - better encoding handling - fixes bsc#1082696 and bsc#1076410 - fix unicode in containers - move to python3 - added logging for better debugging changesgenerate - raise exception if no changesauthor given - Stop using @opensuse.org addresses to indicate a missing address - move argparse dep to -common package - allow submodule and ssl options in appimage - sync spec file as used in openSUSE:Tools project - check encoding problems for svn and print proper error msg - added new param '--locale' - separate service file installation in GNUmakefile - added glibc as Recommends in spec file - cleanup for broken svn caches - another fix for unicode problem in obs_scm - Final fix for unicode in filenames - Another attempt to fix unicode filenames in prep_tree_for_archive - Another attempt to fix unicode filenames in prep_tree_for_archive - fix bug with unicode filenames in prep_tree_for_archive - reuse _service*_servicedata/changes files from previous service runs - fix problems with unicode characters in commit messages for changeloggenerate - fix encoding issues if commit message contains utf8 char - revert encoding for old changes file - remove hardcoded utf-8 encodings - Add support for extract globbing - split pylint2 in GNUmakefile - fix check for "--reproducible" - create reproducible obscpio archives - fix regression from 44b3bee - Support also SSH urls for Git - check name/version option in obsinfo for slashes - check url for remote url - check symlinks in subdir parameter - check filename for slashes - disable follow_symlinks in extract feature - switch to obs_scm for this package - run download_files in appimage and snapcraft case - check --extract file path for parent dir - Fix parameter descriptions - changed os.removedirs -> shutil.rmtree - Adding information regarding the *package-metadata* option for the *tar* service The tar service is highly useful in combination with the *obscpio* service. After the fix for the metadata for the latter one, it is important to inform the users of the *tar* service that metadata is kept only if the flag *package-metadata* is enabled. Add the flag to the .service file for mentioning that. - Allow metadata packing for CPIO archives when desired As of now, metadata are always excluded from *obscpio* packages. This is because the *package-metadata* flag is ignored; this change (should) make *obscpio* aware of it. - improve handling of corrupt git cache directories - only do git stash save/pop if we have a non-empty working tree (#228) - don't allow DEBUG_TAR_SCM to change behaviour (#240) - add stub user docs in lieu of something proper (#238) - Remove clone_dir if clone fails - python-unittest2 is only required for the optional make check - move python-unittest2 dep to test suite only part (submission by olh) - Removing redundant pass statement - missing import for logging functions. - [backend] Adding http proxy support - python-unittest2 is only required for the optional make check - make installation of scm's optional - add a lot more detail to README - Git clone with --no-checkout in prepare_working_copy - Refactor and simplify git prepare_working_copy - Only use current dir if it actually looks like git (Fixes #202) - reactivate test_obscpio_extract_d - fix broken test create_archive - fix broken tests for broken-links - changed PREFIX in Gnumakefile to /usr - new cli option --skip-cleanup - fix for broken links - fix reference to snapcraft YAML file - fix docstring typo in TarSCM.scm.tar.fetch_upstream - acknowledge deficiencies in dev docs - wrap long lines in README This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-329=1 Package List: - openSUSE Backports SLE-15 (noarch): obs-service-appimage-0.10.5.1551309990.79898c7-bp150.3.3.1 obs-service-obs_scm-0.10.5.1551309990.79898c7-bp150.3.3.1 obs-service-obs_scm-common-0.10.5.1551309990.79898c7-bp150.3.3.1 obs-service-snapcraft-0.10.5.1551309990.79898c7-bp150.3.3.1 obs-service-tar-0.10.5.1551309990.79898c7-bp150.3.3.1 obs-service-tar_scm-0.10.5.1551309990.79898c7-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-12473.html https://www.suse.com/security/cve/CVE-2018-12474.html https://www.suse.com/security/cve/CVE-2018-12476.html https://bugzilla.suse.com/1076410 https://bugzilla.suse.com/1082696 https://bugzilla.suse.com/1105361 https://bugzilla.suse.com/1107507 https://bugzilla.suse.com/1107944 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0328-1: moderate: Security update for libcomps
by opensuse-security＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Security Update: Security update for libcomps ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0328-1 Rating: moderate References: #1122841 Cross-References: CVE-2019-3817 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libcomps fixes the following issue: Security issue fixed: - CVE-2019-3817: Fixed a use-after-free vulnerability in comps_objmradix.c:comps_objmrtree_unite() function where could allow to application crash or code execution (bsc#1122841). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-328=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libcomps-devel-0.1.8-bp150.3.3.1 libcomps0_1_6-0.1.8-bp150.3.3.1 python2-libcomps-0.1.8-bp150.3.3.1 python3-libcomps-0.1.8-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): libcomps-doc-0.1.8-bp150.3.3.1 python-libcomps-doc-0.1.8-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-3817.html https://bugzilla.suse.com/1122841 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0325-1: important: Security update for freerdp
by opensuse-security＠opensuse.org 13 Mar '19

13 Mar '19

openSUSE Security Update: Security update for freerdp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0325-1 Rating: important References: #1085416 #1087240 #1103557 #1104918 #1112028 #1116708 #1117963 #1117964 #1117965 #1117966 #1117967 #1120507 Cross-References: CVE-2018-0886 CVE-2018-1000852 CVE-2018-8784 CVE-2018-8785 CVE-2018-8786 CVE-2018-8787 CVE-2018-8788 CVE-2018-8789 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has four fixes is now available. Description: This update for freerdp to version 2.0.0~rc4 fixes the following issues: Security issues fixed: - CVE-2018-0886: Fix a remote code execution vulnerability (CredSSP) (bsc#1085416, bsc#1087240, bsc#1104918) - CVE-2018-8789: Fix several denial of service vulnerabilities in the in the NTLM Authentication module (bsc#1117965) - CVE-2018-8785: Fix a potential remote code execution vulnerability in the zgfx_decompress function (bsc#1117967) - CVE-2018-8786: Fix a potential remote code execution vulnerability in the update_read_bitmap_update function (bsc#1117966) - CVE-2018-8787: Fix a potential remote code execution vulnerability in the gdi_Bitmap_Decompress function (bsc#1117964) - CVE-2018-8788: Fix a potential remote code execution vulnerability in the nsc_rle_decode function (bsc#1117963) - CVE-2018-8784: Fix a potential remote code execution vulnerability in the zgfx_decompress_segment function (bsc#1116708) - CVE-2018-1000852: Fixed a remote memory access in the drdynvc_process_capability_request function (bsc#1120507) Other issues: - Upgraded to version 2.0.0-rc4 (FATE#326739) - Security and stability improvements, including bsc#1103557 and bsc#1112028 - gateway: multiple fixes and improvements - client/X11: support for rail (remote app) icons was added - The licensing code was re-worked: Per-device licenses are now saved on the client and used on re-connect: WARNING: this is a change in FreeRDP behavior regarding licensing. If the old behavior is required, or no licenses should be saved use the new command line option +old-license (gh#/FreeRDP/FreeRDP#4979) - Improved order handling - only orders that were enable during capability exchange are accepted. WARNING and NOTE: some servers do improperly send orders that weren't negotiated, for such cases the new command line option /relax-order-checks was added to disable the strict order checking. If connecting to xrdp the options /relax-order-checks *and* +glyph-cache are required. (gh#/FreeRDP/FreeRDP#4926) - Fixed automount issues - Fixed several audio and microphone related issues - Fixed X11 Right-Ctrl ungrab feature - Fixed race condition in rdpsnd channel server. - Disabled SSE2 for ARM and powerpc This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-325=1 Package List: - openSUSE Leap 15.0 (x86_64): freerdp-2.0.0~rc4-lp150.2.3.1 freerdp-debuginfo-2.0.0~rc4-lp150.2.3.1 freerdp-debugsource-2.0.0~rc4-lp150.2.3.1 freerdp-devel-2.0.0~rc4-lp150.2.3.1 freerdp-server-2.0.0~rc4-lp150.2.3.1 freerdp-server-debuginfo-2.0.0~rc4-lp150.2.3.1 freerdp-wayland-2.0.0~rc4-lp150.2.3.1 freerdp-wayland-debuginfo-2.0.0~rc4-lp150.2.3.1 libfreerdp2-2.0.0~rc4-lp150.2.3.1 libfreerdp2-debuginfo-2.0.0~rc4-lp150.2.3.1 libuwac0-0-2.0.0~rc4-lp150.2.3.1 libuwac0-0-debuginfo-2.0.0~rc4-lp150.2.3.1 libwinpr2-2.0.0~rc4-lp150.2.3.1 libwinpr2-debuginfo-2.0.0~rc4-lp150.2.3.1 uwac0-0-devel-2.0.0~rc4-lp150.2.3.1 winpr2-devel-2.0.0~rc4-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-0886.html https://www.suse.com/security/cve/CVE-2018-1000852.html https://www.suse.com/security/cve/CVE-2018-8784.html https://www.suse.com/security/cve/CVE-2018-8785.html https://www.suse.com/security/cve/CVE-2018-8786.html https://www.suse.com/security/cve/CVE-2018-8787.html https://www.suse.com/security/cve/CVE-2018-8788.html https://www.suse.com/security/cve/CVE-2018-8789.html https://bugzilla.suse.com/1085416 https://bugzilla.suse.com/1087240 https://bugzilla.suse.com/1103557 https://bugzilla.suse.com/1104918 https://bugzilla.suse.com/1112028 https://bugzilla.suse.com/1116708 https://bugzilla.suse.com/1117963 https://bugzilla.suse.com/1117964 https://bugzilla.suse.com/1117965 https://bugzilla.suse.com/1117966 https://bugzilla.suse.com/1117967 https://bugzilla.suse.com/1120507 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0327-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 13 Mar '19

13 Mar '19

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0327-1 Rating: important References: #1013882 #1101676 #1101677 #1101678 #1103342 #1111858 #1111859 #1112368 #1112377 #1112384 #1112386 #1112391 #1112397 #1112404 #1112415 #1112417 #1112421 #1112432 #1112767 #1116686 #1118754 #1120041 #1122198 #1122475 #1127027 Cross-References: CVE-2016-9843 CVE-2018-3058 CVE-2018-3060 CVE-2018-3063 CVE-2018-3064 CVE-2018-3066 CVE-2018-3143 CVE-2018-3156 CVE-2018-3162 CVE-2018-3173 CVE-2018-3174 CVE-2018-3185 CVE-2018-3200 CVE-2018-3251 CVE-2018-3277 CVE-2018-3282 CVE-2018-3284 CVE-2019-2510 CVE-2019-2537 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 19 vulnerabilities and has 6 fixes is now available. Description: This update for mariadb to version 10.2.22 fixes the following issues: Security issues fixed: - CVE-2019-2510: Fixed a vulnerability which can lead to MySQL compromise and lead to Denial of Service (bsc#1122198). - CVE-2019-2537: Fixed a vulnerability which can lead to MySQL compromise and lead to Denial of Service (bsc#1122198). - CVE-2018-3284: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112377) - CVE-2018-3282: Server Storage Engines unspecified vulnerability (CPU Oct 2018) (bsc#1112432) - CVE-2018-3277: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112391) - CVE-2018-3251: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112397) - CVE-2018-3200: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112404) - CVE-2018-3185: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112384) - CVE-2018-3174: Client programs unspecified vulnerability (CPU Oct 2018) (bsc#1112368) - CVE-2018-3173: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112386) - CVE-2018-3162: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112415) - CVE-2018-3156: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112417) - CVE-2018-3143: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112421) - CVE-2018-3066: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent Server Options). (bsc#1101678) - CVE-2018-3064: InnoDB unspecified vulnerability (CPU Jul 2018) (bsc#1103342) - CVE-2018-3063: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent Server Security Privileges). (bsc#1101677) - CVE-2018-3058: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent MyISAM). (bsc#1101676) - CVE-2016-9843: Big-endian out-of-bounds pointer (bsc#1013882) Non-security issues fixed: - Fixed an issue where mysl_install_db fails due to incorrect basedir (bsc#1127027). - Fixed an issue where the lograte was not working (bsc#1112767). - Backport Information Schema CHECK_CONSTRAINTS Table. - Maximum value of table_definition_cache is now 2097152. - InnoDB ALTER TABLE fixes. - Galera crash recovery fixes. - Encryption fixes. - Remove xtrabackup dependency as MariaDB ships a build in mariabackup so xtrabackup is not needed (bsc#1122475). - Maria DB testsuite - test main.plugin_auth failed (bsc#1111859) - Maria DB testsuite - test encryption.second_plugin-12863 failed (bsc#1111858) - Remove PerconaFT from the package as it has AGPL licence (bsc#1118754) - remove PerconaFT from the package as it has AGPL licence (bsc#1118754) - Database corruption after renaming a prefix-indexed column (bsc#1120041) Release notes and changelog: - https://mariadb.com/kb/en/library/mariadb-10222-release-notes - https://mariadb.com/kb/en/library/mariadb-10222-changelog/ This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-327=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libmysqld-devel-10.2.22-lp150.2.9.1 libmysqld19-10.2.22-lp150.2.9.1 libmysqld19-debuginfo-10.2.22-lp150.2.9.1 mariadb-10.2.22-lp150.2.9.1 mariadb-bench-10.2.22-lp150.2.9.1 mariadb-bench-debuginfo-10.2.22-lp150.2.9.1 mariadb-client-10.2.22-lp150.2.9.1 mariadb-client-debuginfo-10.2.22-lp150.2.9.1 mariadb-debuginfo-10.2.22-lp150.2.9.1 mariadb-debugsource-10.2.22-lp150.2.9.1 mariadb-galera-10.2.22-lp150.2.9.1 mariadb-test-10.2.22-lp150.2.9.1 mariadb-test-debuginfo-10.2.22-lp150.2.9.1 mariadb-tools-10.2.22-lp150.2.9.1 mariadb-tools-debuginfo-10.2.22-lp150.2.9.1 - openSUSE Leap 15.0 (noarch): mariadb-errormessages-10.2.22-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2016-9843.html https://www.suse.com/security/cve/CVE-2018-3058.html https://www.suse.com/security/cve/CVE-2018-3060.html https://www.suse.com/security/cve/CVE-2018-3063.html https://www.suse.com/security/cve/CVE-2018-3064.html https://www.suse.com/security/cve/CVE-2018-3066.html https://www.suse.com/security/cve/CVE-2018-3143.html https://www.suse.com/security/cve/CVE-2018-3156.html https://www.suse.com/security/cve/CVE-2018-3162.html https://www.suse.com/security/cve/CVE-2018-3173.html https://www.suse.com/security/cve/CVE-2018-3174.html https://www.suse.com/security/cve/CVE-2018-3185.html https://www.suse.com/security/cve/CVE-2018-3200.html https://www.suse.com/security/cve/CVE-2018-3251.html https://www.suse.com/security/cve/CVE-2018-3277.html https://www.suse.com/security/cve/CVE-2018-3282.html https://www.suse.com/security/cve/CVE-2018-3284.html https://www.suse.com/security/cve/CVE-2019-2510.html https://www.suse.com/security/cve/CVE-2019-2537.html https://bugzilla.suse.com/1013882 https://bugzilla.suse.com/1101676 https://bugzilla.suse.com/1101677 https://bugzilla.suse.com/1101678 https://bugzilla.suse.com/1103342 https://bugzilla.suse.com/1111858 https://bugzilla.suse.com/1111859 https://bugzilla.suse.com/1112368 https://bugzilla.suse.com/1112377 https://bugzilla.suse.com/1112384 https://bugzilla.suse.com/1112386 https://bugzilla.suse.com/1112391 https://bugzilla.suse.com/1112397 https://bugzilla.suse.com/1112404 https://bugzilla.suse.com/1112415 https://bugzilla.suse.com/1112417 https://bugzilla.suse.com/1112421 https://bugzilla.suse.com/1112432 https://bugzilla.suse.com/1112767 https://bugzilla.suse.com/1116686 https://bugzilla.suse.com/1118754 https://bugzilla.suse.com/1120041 https://bugzilla.suse.com/1122198 https://bugzilla.suse.com/1122475 https://bugzilla.suse.com/1127027 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0326-1: important: Security update for obs-service-tar_scm
by opensuse-security＠opensuse.org 13 Mar '19

13 Mar '19

openSUSE Security Update: Security update for obs-service-tar_scm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0326-1 Rating: important References: #1076410 #1082696 #1105361 #1107507 #1107944 Cross-References: CVE-2018-12473 CVE-2018-12474 CVE-2018-12476 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for obs-service-tar_scm fixes the following issues: Security vulnerabilities addressed: - CVE-2018-12473: Fixed a path traversal issue, which allowed users to access files outside of the repository using relative paths (bsc#1105361) - CVE-2018-12474: Fixed an issue whereby crafted service parameters allowed for unexpected behaviour (bsc#1107507) - CVE-2018-12476: Fixed an issue whereby the outfilename parameter allowed to write files outside of package directory (bsc#1107944) Other bug fixes and changes made: - Prefer UTF-8 locale as output format for changes - added KankuFile - fix problems with unicode source files - added python-six to Requires in specfile - better encoding handling - fixes bsc#1082696 and bsc#1076410 - fix unicode in containers - move to python3 - added logging for better debugging changesgenerate - raise exception if no changesauthor given - Stop using @opensuse.org addresses to indicate a missing address - move argparse dep to -common package - allow submodule and ssl options in appimage - sync spec file as used in openSUSE:Tools project - check encoding problems for svn and print proper error msg - added new param '--locale' - separate service file installation in GNUmakefile - added glibc as Recommends in spec file - cleanup for broken svn caches - another fix for unicode problem in obs_scm - Final fix for unicode in filenames - Another attempt to fix unicode filenames in prep_tree_for_archive - Another attempt to fix unicode filenames in prep_tree_for_archive - fix bug with unicode filenames in prep_tree_for_archive - reuse _service*_servicedata/changes files from previous service runs - fix problems with unicode characters in commit messages for changeloggenerate - fix encoding issues if commit message contains utf8 char - revert encoding for old changes file - remove hardcoded utf-8 encodings - Add support for extract globbing - split pylint2 in GNUmakefile - fix check for "--reproducible" - create reproducible obscpio archives - fix regression from 44b3bee - Support also SSH urls for Git - check name/version option in obsinfo for slashes - check url for remote url - check symlinks in subdir parameter - check filename for slashes - disable follow_symlinks in extract feature - switch to obs_scm for this package - run download_files in appimage and snapcraft case - check --extract file path for parent dir - Fix parameter descriptions - changed os.removedirs -> shutil.rmtree - Adding information regarding the *package-metadata* option for the *tar* service The tar service is highly useful in combination with the *obscpio* service. After the fix for the metadata for the latter one, it is important to inform the users of the *tar* service that metadata is kept only if the flag *package-metadata* is enabled. Add the flag to the .service file for mentioning that. - Allow metadata packing for CPIO archives when desired As of now, metadata are always excluded from *obscpio* packages. This is because the *package-metadata* flag is ignored; this change (should) make *obscpio* aware of it. - improve handling of corrupt git cache directories - only do git stash save/pop if we have a non-empty working tree (#228) - don't allow DEBUG_TAR_SCM to change behaviour (#240) - add stub user docs in lieu of something proper (#238) - Remove clone_dir if clone fails - python-unittest2 is only required for the optional make check - move python-unittest2 dep to test suite only part (submission by olh) - Removing redundant pass statement - missing import for logging functions. - [backend] Adding http proxy support - python-unittest2 is only required for the optional make check - make installation of scm's optional - add a lot more detail to README - Git clone with --no-checkout in prepare_working_copy - Refactor and simplify git prepare_working_copy - Only use current dir if it actually looks like git (Fixes #202) - reactivate test_obscpio_extract_d - fix broken test create_archive - fix broken tests for broken-links - changed PREFIX in Gnumakefile to /usr - new cli option --skip-cleanup - fix for broken links - fix reference to snapcraft YAML file - fix docstring typo in TarSCM.scm.tar.fetch_upstream - acknowledge deficiencies in dev docs - wrap long lines in README This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-326=1 Package List: - openSUSE Leap 15.0 (noarch): obs-service-appimage-0.10.5.1551309990.79898c7-lp150.2.3.1 obs-service-obs_scm-0.10.5.1551309990.79898c7-lp150.2.3.1 obs-service-obs_scm-common-0.10.5.1551309990.79898c7-lp150.2.3.1 obs-service-snapcraft-0.10.5.1551309990.79898c7-lp150.2.3.1 obs-service-tar-0.10.5.1551309990.79898c7-lp150.2.3.1 obs-service-tar_scm-0.10.5.1551309990.79898c7-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-12473.html https://www.suse.com/security/cve/CVE-2018-12474.html https://www.suse.com/security/cve/CVE-2018-12476.html https://bugzilla.suse.com/1076410 https://bugzilla.suse.com/1082696 https://bugzilla.suse.com/1105361 https://bugzilla.suse.com/1107507 https://bugzilla.suse.com/1107944 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0323-1: moderate: Security update for libcomps
by opensuse-security＠opensuse.org 11 Mar '19

11 Mar '19

openSUSE Security Update: Security update for libcomps ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0323-1 Rating: moderate References: #1122841 Cross-References: CVE-2019-3817 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libcomps fixes the following issue: Security issue fixed: - CVE-2019-3817: Fixed a use-after-free vulnerability in comps_objmradix.c:comps_objmrtree_unite() function where could allow to application crash or code execution (bsc#1122841). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-323=1 Package List: - openSUSE Leap 15.0 (noarch): libcomps-doc-0.1.8-lp150.2.3.1 python-libcomps-doc-0.1.8-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libcomps-debuginfo-0.1.8-lp150.2.3.1 libcomps-debugsource-0.1.8-lp150.2.3.1 libcomps-devel-0.1.8-lp150.2.3.1 libcomps0_1_6-0.1.8-lp150.2.3.1 libcomps0_1_6-debuginfo-0.1.8-lp150.2.3.1 python2-libcomps-0.1.8-lp150.2.3.1 python2-libcomps-debuginfo-0.1.8-lp150.2.3.1 python3-libcomps-0.1.8-lp150.2.3.1 python3-libcomps-debuginfo-0.1.8-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-3817.html https://bugzilla.suse.com/1122841 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0322-1: important: Security update for hiawatha
by opensuse-security＠opensuse.org 09 Mar '19

09 Mar '19

openSUSE Security Update: Security update for hiawatha ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0322-1 Rating: important References: #1125751 Cross-References: CVE-2019-8358 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for hiawatha to version 10.8.4 fixes the following issue: Security issue fixed: - CVE-2019-8358: Fixed a vulnerability which allowed a remote atacker to perform directory traversal when AllowDotFiles was enabled (bsc#1125751). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-322=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): hiawatha-10.8.4-bp150.3.3.1 hiawatha-letsencrypt-10.8.4-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-8358.html https://bugzilla.suse.com/1125751 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0310-1: moderate: Security update for gdm
by opensuse-security＠opensuse.org 08 Mar '19

08 Mar '19

openSUSE Security Update: Security update for gdm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0310-1 Rating: moderate References: #1112294 #1112578 #1113245 #1113700 #1120307 #1124628 Cross-References: CVE-2019-3825 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has 5 fixes is now available. Description: This update for gdm fixes the following issues: Security issue fixed: - CVE-2019-3825: Fixed a lock screen bypass when timed login was enabled (bsc#1124628). Other issues fixed: - GLX applications do not work well when the proprietary nvidia driver is used with a wayland session. Because of that this update disables wayland on that hardware (bsc#1112578). - Fixed an issue where gdm restart fails to kill user processes (bsc#1112294 and bsc#1113245). - Fixed a System halt in the screen with message "End of ORACLE section" (bsc#1120307). - Fixed an issue which did not allow the returning to text console when gdm is stopped (bsc#1113700). - Fixed an issue which was causing system hang during the load of gdm (bsc#1112578). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-310=1 Package List: - openSUSE Leap 15.0 (x86_64): gdm-3.26.2.1-lp150.11.9.1 gdm-debuginfo-3.26.2.1-lp150.11.9.1 gdm-debugsource-3.26.2.1-lp150.11.9.1 gdm-devel-3.26.2.1-lp150.11.9.1 libgdm1-3.26.2.1-lp150.11.9.1 libgdm1-debuginfo-3.26.2.1-lp150.11.9.1 typelib-1_0-Gdm-1_0-3.26.2.1-lp150.11.9.1 - openSUSE Leap 15.0 (noarch): gdm-branding-upstream-3.26.2.1-lp150.11.9.1 gdm-lang-3.26.2.1-lp150.11.9.1 gdmflexiserver-3.26.2.1-lp150.11.9.1 References: https://www.suse.com/security/cve/CVE-2019-3825.html https://bugzilla.suse.com/1112294 https://bugzilla.suse.com/1112578 https://bugzilla.suse.com/1113245 https://bugzilla.suse.com/1113700 https://bugzilla.suse.com/1120307 https://bugzilla.suse.com/1124628 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0306-1: important: Security update for ceph
by opensuse-security＠opensuse.org 08 Mar '19

08 Mar '19

openSUSE Security Update: Security update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0306-1 Rating: important References: #1111177 #1113246 #1114710 #1121567 Cross-References: CVE-2018-14662 CVE-2018-16846 CVE-2018-16889 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for ceph fixes the following issues: Security issues fixed: - CVE-2018-14662: mon: limit caps allowed to access the config store (bsc#1111177) - CVE-2018-16846: rgw: enforce bounds on max-keys/max-uploads/max-parts (bsc#1114710) - CVE-2018-16889: rgw: sanitize customer encryption keys from log output in v4 auth (bsc#1121567) Non-security issue fixed: - os/bluestore: avoid frequent allocator dump on bluefs rebalance failure (bsc#1113246) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-306=1 Package List: - openSUSE Leap 42.3 (x86_64): ceph-12.2.10+git.1549630712.bb089269ea-21.1 ceph-base-12.2.10+git.1549630712.bb089269ea-21.1 ceph-base-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 ceph-common-12.2.10+git.1549630712.bb089269ea-21.1 ceph-common-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 ceph-debugsource-12.2.10+git.1549630712.bb089269ea-21.1 ceph-fuse-12.2.10+git.1549630712.bb089269ea-21.1 ceph-fuse-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 ceph-mds-12.2.10+git.1549630712.bb089269ea-21.1 ceph-mds-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 ceph-mgr-12.2.10+git.1549630712.bb089269ea-21.1 ceph-mgr-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 ceph-mon-12.2.10+git.1549630712.bb089269ea-21.1 ceph-mon-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 ceph-osd-12.2.10+git.1549630712.bb089269ea-21.1 ceph-osd-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 ceph-radosgw-12.2.10+git.1549630712.bb089269ea-21.1 ceph-radosgw-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 ceph-resource-agents-12.2.10+git.1549630712.bb089269ea-21.1 ceph-test-12.2.10+git.1549630712.bb089269ea-21.1 ceph-test-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 ceph-test-debugsource-12.2.10+git.1549630712.bb089269ea-21.1 libcephfs-devel-12.2.10+git.1549630712.bb089269ea-21.1 libcephfs2-12.2.10+git.1549630712.bb089269ea-21.1 libcephfs2-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 librados-devel-12.2.10+git.1549630712.bb089269ea-21.1 librados-devel-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 librados2-12.2.10+git.1549630712.bb089269ea-21.1 librados2-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 libradosstriper-devel-12.2.10+git.1549630712.bb089269ea-21.1 libradosstriper1-12.2.10+git.1549630712.bb089269ea-21.1 libradosstriper1-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 librbd-devel-12.2.10+git.1549630712.bb089269ea-21.1 librbd1-12.2.10+git.1549630712.bb089269ea-21.1 librbd1-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 librgw-devel-12.2.10+git.1549630712.bb089269ea-21.1 librgw2-12.2.10+git.1549630712.bb089269ea-21.1 librgw2-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 python-ceph-compat-12.2.10+git.1549630712.bb089269ea-21.1 python-cephfs-12.2.10+git.1549630712.bb089269ea-21.1 python-cephfs-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 python-rados-12.2.10+git.1549630712.bb089269ea-21.1 python-rados-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 python-rbd-12.2.10+git.1549630712.bb089269ea-21.1 python-rbd-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 python-rgw-12.2.10+git.1549630712.bb089269ea-21.1 python-rgw-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 python3-ceph-argparse-12.2.10+git.1549630712.bb089269ea-21.1 python3-cephfs-12.2.10+git.1549630712.bb089269ea-21.1 python3-cephfs-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 python3-rados-12.2.10+git.1549630712.bb089269ea-21.1 python3-rados-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 python3-rbd-12.2.10+git.1549630712.bb089269ea-21.1 python3-rbd-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 python3-rgw-12.2.10+git.1549630712.bb089269ea-21.1 python3-rgw-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 rados-objclass-devel-12.2.10+git.1549630712.bb089269ea-21.1 rbd-fuse-12.2.10+git.1549630712.bb089269ea-21.1 rbd-fuse-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 rbd-mirror-12.2.10+git.1549630712.bb089269ea-21.1 rbd-mirror-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 rbd-nbd-12.2.10+git.1549630712.bb089269ea-21.1 rbd-nbd-debuginfo-12.2.10+git.1549630712.bb089269ea-21.1 References: https://www.suse.com/security/cve/CVE-2018-14662.html https://www.suse.com/security/cve/CVE-2018-16846.html https://www.suse.com/security/cve/CVE-2018-16889.html https://bugzilla.suse.com/1111177 https://bugzilla.suse.com/1113246 https://bugzilla.suse.com/1114710 https://bugzilla.suse.com/1121567 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0309-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 08 Mar '19

08 Mar '19

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0309-1 Rating: important References: #1124937 Cross-References: CVE-2019-6212 CVE-2019-6215 CVE-2019-6216 CVE-2019-6217 CVE-2019-6226 CVE-2019-6227 CVE-2019-6229 CVE-2019-6233 CVE-2019-6234 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for webkit2gtk3 to version 2.22.6 fixes the following issues: Security issues fixed: - CVE-2019-6212: Fixed multiple memory corruption vulnerabilities which could allow arbitrary code execution during the processing of special crafted web-content. - CVE-2019-6215: Fixed a type confusion vulnerability which could allow arbitrary code execution during the processing of special crafted web-content. - CVE-2019-6216: Fixed multiple memory corruption vulnerabilities which could allow arbitrary code execution during the processing of special crafted web-content. - CVE-2019-6217: Fixed multiple memory corruption vulnerabilities which could allow arbitrary code execution during the processing of special crafted web-content. - CVE-2019-6226: Fixed multiple memory corruption vulnerabilities which could allow arbitrary code execution during the processing of special crafted web-content. - CVE-2019-6227: Fixed a memory corruption vulnerability which could allow arbitrary code execution during the processing of special crafted web-content. - CVE-2019-6229: Fixed a logic issue by improving validation which could allow arbitrary code execution during the processing of special crafted web-content. - CVE-2019-6233: Fixed a memory corruption vulnerability which could allow arbitrary code execution during the processing of special crafted web-content. - CVE-2019-6234: Fixed a memory corruption vulnerability which could allow arbitrary code execution during the processing of special crafted web-content. Other issues addressed: - Update to version 2.22.6 (bsc#1124937). - Kinetic scrolling slow down smoothly when reaching the ends of pages, instead of abruptly, to better match the GTK+ behaviour. - Fixed Web inspector magnifier under Wayland. - Fixed garbled rendering of some websites (e.g. YouTube) while scrolling under X11. - Fixed several crashes, race conditions, and rendering issues. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-309=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.22.6-21.1 libjavascriptcoregtk-4_0-18-debuginfo-2.22.6-21.1 libwebkit2gtk-4_0-37-2.22.6-21.1 libwebkit2gtk-4_0-37-debuginfo-2.22.6-21.1 typelib-1_0-JavaScriptCore-4_0-2.22.6-21.1 typelib-1_0-WebKit2-4_0-2.22.6-21.1 typelib-1_0-WebKit2WebExtension-4_0-2.22.6-21.1 webkit-jsc-4-2.22.6-21.1 webkit-jsc-4-debuginfo-2.22.6-21.1 webkit2gtk-4_0-injected-bundles-2.22.6-21.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.22.6-21.1 webkit2gtk3-debugsource-2.22.6-21.1 webkit2gtk3-devel-2.22.6-21.1 webkit2gtk3-minibrowser-2.22.6-21.1 webkit2gtk3-minibrowser-debuginfo-2.22.6-21.1 webkit2gtk3-plugin-process-gtk2-2.22.6-21.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.22.6-21.1 - openSUSE Leap 42.3 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.22.6-21.1 libjavascriptcoregtk-4_0-18-debuginfo-32bit-2.22.6-21.1 libwebkit2gtk-4_0-37-32bit-2.22.6-21.1 libwebkit2gtk-4_0-37-debuginfo-32bit-2.22.6-21.1 - openSUSE Leap 42.3 (noarch): libwebkit2gtk3-lang-2.22.6-21.1 References: https://www.suse.com/security/cve/CVE-2019-6212.html https://www.suse.com/security/cve/CVE-2019-6215.html https://www.suse.com/security/cve/CVE-2019-6216.html https://www.suse.com/security/cve/CVE-2019-6217.html https://www.suse.com/security/cve/CVE-2019-6226.html https://www.suse.com/security/cve/CVE-2019-6227.html https://www.suse.com/security/cve/CVE-2019-6229.html https://www.suse.com/security/cve/CVE-2019-6233.html https://www.suse.com/security/cve/CVE-2019-6234.html https://bugzilla.suse.com/1124937 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0308-1: moderate: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 08 Mar '19

08 Mar '19

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0308-1 Rating: moderate References: #1119553 #1119554 #1119555 #1119556 #1119557 #1119558 #1124937 Cross-References: CVE-2018-4437 CVE-2018-4438 CVE-2018-4441 CVE-2018-4442 CVE-2018-4443 CVE-2018-4464 CVE-2019-6212 CVE-2019-6215 CVE-2019-6216 CVE-2019-6217 CVE-2019-6226 CVE-2019-6227 CVE-2019-6229 CVE-2019-6233 CVE-2019-6234 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for webkit2gtk3 to version 2.22.6 fixes the following issues (boo#1124937 boo#1119558): Security vulnerabilities fixed: - CVE-2018-4437: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. (boo#1119553) - CVE-2018-4438: Processing maliciously crafted web content may lead to arbitrary code execution. A logic issue existed resulting in memory corruption. This was addressed with improved state management. (boo#1119554) - CVE-2018-4441: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119555) - CVE-2018-4442: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119556) - CVE-2018-4443: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119557) - CVE-2018-4464: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. (boo#1119558) - CVE-2019-6212: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. - CVE-2019-6215: Processing maliciously crafted web content may lead to arbitrary code execution. A type confusion issue was addressed with improved memory handling. - CVE-2019-6216: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. - CVE-2019-6217: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. - CVE-2019-6226: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. - CVE-2019-6227: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. - CVE-2019-6229: Processing maliciously crafted web content may lead to universal cross site scripting. A logic issue was addressed with improved validation. - CVE-2019-6233: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. - CVE-2019-6234: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. Other bug fixes and changes: - Make kinetic scrolling slow down smoothly when reaching the ends of pages, instead of abruptly, to better match the GTK+ behaviour. - Fix Web inspector magnifier under Wayland. - Fix garbled rendering of some websites (e.g. YouTube) while scrolling under X11. - Fix several crashes, race conditions, and rendering issues. For a detailed list of changes, please refer to: - https://webkitgtk.org/security/WSA-2019-0001.html - https://webkitgtk.org/2019/02/09/webkitgtk2.22.6-released.html - https://webkitgtk.org/security/WSA-2018-0009.html - https://webkitgtk.org/2018/12/13/webkitgtk2.22.5-released.html This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-308=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.22.6-lp150.2.12.1 libjavascriptcoregtk-4_0-18-debuginfo-2.22.6-lp150.2.12.1 libwebkit2gtk-4_0-37-2.22.6-lp150.2.12.1 libwebkit2gtk-4_0-37-debuginfo-2.22.6-lp150.2.12.1 typelib-1_0-JavaScriptCore-4_0-2.22.6-lp150.2.12.1 typelib-1_0-WebKit2-4_0-2.22.6-lp150.2.12.1 typelib-1_0-WebKit2WebExtension-4_0-2.22.6-lp150.2.12.1 webkit-jsc-4-2.22.6-lp150.2.12.1 webkit-jsc-4-debuginfo-2.22.6-lp150.2.12.1 webkit2gtk-4_0-injected-bundles-2.22.6-lp150.2.12.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.22.6-lp150.2.12.1 webkit2gtk3-debugsource-2.22.6-lp150.2.12.1 webkit2gtk3-devel-2.22.6-lp150.2.12.1 webkit2gtk3-minibrowser-2.22.6-lp150.2.12.1 webkit2gtk3-minibrowser-debuginfo-2.22.6-lp150.2.12.1 webkit2gtk3-plugin-process-gtk2-2.22.6-lp150.2.12.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.22.6-lp150.2.12.1 - openSUSE Leap 15.0 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.22.6-lp150.2.12.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.22.6-lp150.2.12.1 libwebkit2gtk-4_0-37-32bit-2.22.6-lp150.2.12.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.22.6-lp150.2.12.1 - openSUSE Leap 15.0 (noarch): libwebkit2gtk3-lang-2.22.6-lp150.2.12.1 References: https://www.suse.com/security/cve/CVE-2018-4437.html https://www.suse.com/security/cve/CVE-2018-4438.html https://www.suse.com/security/cve/CVE-2018-4441.html https://www.suse.com/security/cve/CVE-2018-4442.html https://www.suse.com/security/cve/CVE-2018-4443.html https://www.suse.com/security/cve/CVE-2018-4464.html https://www.suse.com/security/cve/CVE-2019-6212.html https://www.suse.com/security/cve/CVE-2019-6215.html https://www.suse.com/security/cve/CVE-2019-6216.html https://www.suse.com/security/cve/CVE-2019-6217.html https://www.suse.com/security/cve/CVE-2019-6226.html https://www.suse.com/security/cve/CVE-2019-6227.html https://www.suse.com/security/cve/CVE-2019-6229.html https://www.suse.com/security/cve/CVE-2019-6233.html https://www.suse.com/security/cve/CVE-2019-6234.html https://bugzilla.suse.com/1119553 https://bugzilla.suse.com/1119554 https://bugzilla.suse.com/1119555 https://bugzilla.suse.com/1119556 https://bugzilla.suse.com/1119557 https://bugzilla.suse.com/1119558 https://bugzilla.suse.com/1124937 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0307-1: moderate: Security update for openssh
by opensuse-security＠opensuse.org 08 Mar '19

08 Mar '19

openSUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0307-1 Rating: moderate References: #1121816 #1121821 #1125687 Cross-References: CVE-2019-6109 CVE-2019-6111 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for openssh fixes the following issues: Security vulnerabilities addressed: - CVE-2019-6109: Fixed an character encoding issue in the progress display of the scp client that could be used to manipulate client output, allowing for spoofing during file transfers (bsc#1121816) - CVE-2019-6111: Properly validate object names received by the scp client to prevent arbitrary file overwrites when interacting with a malicious SSH server (bsc#1121821) Other bug fixes and changes: - Handle brace expansion in scp when checking that filenames sent by the server side match what the client requested (bsc#1125687) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-307=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): openssh-7.6p1-lp150.8.15.2 openssh-cavs-7.6p1-lp150.8.15.2 openssh-cavs-debuginfo-7.6p1-lp150.8.15.2 openssh-debuginfo-7.6p1-lp150.8.15.2 openssh-debugsource-7.6p1-lp150.8.15.2 openssh-fips-7.6p1-lp150.8.15.2 openssh-helpers-7.6p1-lp150.8.15.2 openssh-helpers-debuginfo-7.6p1-lp150.8.15.2 - openSUSE Leap 15.0 (x86_64): openssh-askpass-gnome-7.6p1-lp150.8.15.1 openssh-askpass-gnome-debuginfo-7.6p1-lp150.8.15.1 References: https://www.suse.com/security/cve/CVE-2019-6109.html https://www.suse.com/security/cve/CVE-2019-6111.html https://bugzilla.suse.com/1121816 https://bugzilla.suse.com/1121821 https://bugzilla.suse.com/1125687 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0305-1: moderate: Security update for apache2
by opensuse-security＠opensuse.org 08 Mar '19

08 Mar '19

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0305-1 Rating: moderate References: #1121086 #1122838 #1122839 Cross-References: CVE-2018-17189 CVE-2018-17199 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for apache2 fixes the following issues: Security issues fixed: - CVE-2018-17189: Fixed a denial of service in mod_http2, via slow and unneeded request bodies (bsc#1122838) - CVE-2018-17199: Fixed that mod_session_cookie did not respect expiry time (bsc#1122839) Non-security issue fixed: - sysconfig.d is not created anymore if it already exists (bsc#1121086) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-305=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-2.4.23-37.1 apache2-debuginfo-2.4.23-37.1 apache2-debugsource-2.4.23-37.1 apache2-devel-2.4.23-37.1 apache2-event-2.4.23-37.1 apache2-event-debuginfo-2.4.23-37.1 apache2-example-pages-2.4.23-37.1 apache2-prefork-2.4.23-37.1 apache2-prefork-debuginfo-2.4.23-37.1 apache2-utils-2.4.23-37.1 apache2-utils-debuginfo-2.4.23-37.1 apache2-worker-2.4.23-37.1 apache2-worker-debuginfo-2.4.23-37.1 - openSUSE Leap 42.3 (noarch): apache2-doc-2.4.23-37.1 References: https://www.suse.com/security/cve/CVE-2018-17189.html https://www.suse.com/security/cve/CVE-2018-17199.html https://bugzilla.suse.com/1121086 https://bugzilla.suse.com/1122838 https://bugzilla.suse.com/1122839 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0298-1: important: Security update for chromium
by opensuse-security＠opensuse.org 07 Mar '19

07 Mar '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0298-1 Rating: important References: #1127602 Cross-References: CVE-2019-5786 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for chromium fixes the following issues: Chromium was updated: to 72.0.3626.121: * CVE-2019-5786: Use-after-free in FileReader fixed (boo#1127602) * Feature fixes update only Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-298=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-298=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-298=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-298=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-72.0.3626.121-202.1 chromedriver-debuginfo-72.0.3626.121-202.1 chromium-72.0.3626.121-202.1 chromium-debuginfo-72.0.3626.121-202.1 chromium-debugsource-72.0.3626.121-202.1 - openSUSE Leap 15.0 (x86_64): chromedriver-72.0.3626.121-lp150.2.46.1 chromedriver-debuginfo-72.0.3626.121-lp150.2.46.1 chromium-72.0.3626.121-lp150.2.46.1 chromium-debuginfo-72.0.3626.121-lp150.2.46.1 chromium-debugsource-72.0.3626.121-lp150.2.46.1 - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-72.0.3626.121-bp150.2.37.1 chromedriver-debuginfo-72.0.3626.121-bp150.2.37.1 chromium-72.0.3626.121-bp150.2.37.1 chromium-debuginfo-72.0.3626.121-bp150.2.37.1 chromium-debugsource-72.0.3626.121-bp150.2.37.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-72.0.3626.121-92.1 chromedriver-debuginfo-72.0.3626.121-92.1 chromium-72.0.3626.121-92.1 chromium-debuginfo-72.0.3626.121-92.1 chromium-debugsource-72.0.3626.121-92.1 References: https://www.suse.com/security/cve/CVE-2019-5786.html https://bugzilla.suse.com/1127602 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0298-1: important: Security update for chromium
by opensuse-security＠opensuse.org 07 Mar '19

07 Mar '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0298-1 Rating: important References: #1127602 Cross-References: CVE-2019-5786 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for chromium fixes the following issues: Chromium was updated: to 72.0.3626.121: * CVE-2019-5786: Use-after-free in FileReader fixed (boo#1127602) * Feature fixes update only Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-298=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-72.0.3626.121-92.1 chromedriver-debuginfo-72.0.3626.121-92.1 chromium-72.0.3626.121-92.1 chromium-debuginfo-72.0.3626.121-92.1 chromium-debugsource-72.0.3626.121-92.1 References: https://www.suse.com/security/cve/CVE-2019-5786.html https://bugzilla.suse.com/1127602 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0296-1: moderate: Security update for apache2
by opensuse-security＠opensuse.org 06 Mar '19

06 Mar '19

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0296-1 Rating: moderate References: #1121086 #1122838 #1122839 Cross-References: CVE-2018-17189 CVE-2018-17199 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for apache2 fixes the following issues: Security issues fixed: - CVE-2018-17189: Fixed a denial of service in mod_http2, via slow and unneeded request bodies (bsc#1122838) - CVE-2018-17199: Fixed that mod_session_cookie did not respect expiry time (bsc#1122839) Non-security issue fixed: - sysconfig.d is not created anymore if it already exists (bsc#1121086) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-296=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): apache2-2.4.33-lp150.2.9.1 apache2-debuginfo-2.4.33-lp150.2.9.1 apache2-debugsource-2.4.33-lp150.2.9.1 apache2-devel-2.4.33-lp150.2.9.1 apache2-event-2.4.33-lp150.2.9.1 apache2-event-debuginfo-2.4.33-lp150.2.9.1 apache2-example-pages-2.4.33-lp150.2.9.1 apache2-prefork-2.4.33-lp150.2.9.1 apache2-prefork-debuginfo-2.4.33-lp150.2.9.1 apache2-utils-2.4.33-lp150.2.9.1 apache2-utils-debuginfo-2.4.33-lp150.2.9.1 apache2-worker-2.4.33-lp150.2.9.1 apache2-worker-debuginfo-2.4.33-lp150.2.9.1 - openSUSE Leap 15.0 (noarch): apache2-doc-2.4.33-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-17189.html https://www.suse.com/security/cve/CVE-2018-17199.html https://bugzilla.suse.com/1121086 https://bugzilla.suse.com/1122838 https://bugzilla.suse.com/1122839 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0295-1: important: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc
by opensuse-security＠opensuse.org 06 Mar '19

06 Mar '19

openSUSE Security Update: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0295-1 Rating: important References: #1048046 #1051429 #1114832 #1118897 #1118898 #1118899 #1121967 #1124308 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 CVE-2019-5736 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves four vulnerabilities and has four fixes is now available. Description: This update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc fixes the following issues: Security issues fixed: - CVE-2018-16875: Fixed a CPU Denial of Service (bsc#1118899). - CVE-2018-16874: Fixed a vulnerabity in go get command which could allow directory traversal in GOPATH mode (bsc#1118898). - CVE-2018-16873: Fixed a vulnerability in go get command which could allow remote code execution when executed with -u in GOPATH mode (bsc#1118897). - CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967). Other changes and fixes: - Update shell completion to use Group: System/Shells. - Add daemon.json file with rotation logs configuration (bsc#1114832) - Update to Docker 18.09.1-ce (bsc#1124308) and to to runc 96ec2177ae84. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. - Update go requirements to >= go1.10 - Use -buildmode=pie for tests and binary build (bsc#1048046 and bsc#1051429). - Remove the usage of 'cp -r' to reduce noise in the build logs. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-295=1 Package List: - openSUSE Leap 15.0 (noarch): containerd-test-1.2.2-lp150.4.10.1 docker-bash-completion-18.09.1_ce-lp150.5.13.1 docker-runc-test-1.0.0rc6+gitr3748_96ec2177ae84-lp150.5.14.1 docker-zsh-completion-18.09.1_ce-lp150.5.13.1 runc-test-1.0.0~rc6-lp150.2.7.1 - openSUSE Leap 15.0 (x86_64): containerd-1.2.2-lp150.4.10.1 containerd-ctr-1.2.2-lp150.4.10.1 docker-18.09.1_ce-lp150.5.13.1 docker-debuginfo-18.09.1_ce-lp150.5.13.1 docker-debugsource-18.09.1_ce-lp150.5.13.1 docker-libnetwork-0.7.0.1+gitr2711_2cfbf9b1f981-lp150.3.10.1 docker-libnetwork-debuginfo-0.7.0.1+gitr2711_2cfbf9b1f981-lp150.3.10.1 docker-runc-1.0.0rc6+gitr3748_96ec2177ae84-lp150.5.14.1 docker-runc-debuginfo-1.0.0rc6+gitr3748_96ec2177ae84-lp150.5.14.1 docker-test-18.09.1_ce-lp150.5.13.1 docker-test-debuginfo-18.09.1_ce-lp150.5.13.1 golang-github-docker-libnetwork-0.7.0.1+gitr2711_2cfbf9b1f981-lp150.3.10.1 runc-1.0.0~rc6-lp150.2.7.1 runc-debuginfo-1.0.0~rc6-lp150.2.7.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://www.suse.com/security/cve/CVE-2019-5736.html https://bugzilla.suse.com/1048046 https://bugzilla.suse.com/1051429 https://bugzilla.suse.com/1114832 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899 https://bugzilla.suse.com/1121967 https://bugzilla.suse.com/1124308 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0297-1: moderate: Security update for amavisd-new
by opensuse-security＠opensuse.org 06 Mar '19

06 Mar '19

openSUSE Security Update: Security update for amavisd-new ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0297-1 Rating: moderate References: #1123389 #987887 Cross-References: CVE-2016-1238 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for amavisd-new fixes the following issues: Security issue fixed: - CVE-2016-1238: Workedaround a perl vulnerability by removing a trailing dot element from @INC (bsc#987887). Other issues addressed: - update to version 2.11.1 (bsc#1123389). - amavis-services: bumping up syslog level from LOG_NOTICE to LOG_ERR for a message "PID <pid> went away", and removed redundant newlines from some log messages - avoid warning messages "Use of uninitialized value in subroutine entry" in Encode::MIME::Header when the $check argument is undefined - @sa_userconf_maps has been extended to allow loading of per-recipient (or per-policy bank, or global) SpamAssassin configuration set from LDAP. For consistency with SQL a @sa_userconf_maps entry prefixed with 'ldap:' will load SpamAssassin configuration set using the load_scoreonly_ldap() method. - add some Sanesecurity.Foxhole false positives to the default list @virus_name_to_spam_score_maps - update amavis-milter to version 2.6.1: * Fixed a bug when creating amavisd-new policy bank names This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-297=1 Package List: - openSUSE Leap 15.0 (x86_64): amavisd-new-2.11.1-lp150.5.3.1 amavisd-new-debuginfo-2.11.1-lp150.5.3.1 amavisd-new-debugsource-2.11.1-lp150.5.3.1 amavisd-new-docs-2.11.1-lp150.5.3.1 References: https://www.suse.com/security/cve/CVE-2016-1238.html https://bugzilla.suse.com/1123389 https://bugzilla.suse.com/987887 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0292-1: important: Security update for python
by opensuse-security＠opensuse.org 05 Mar '19

05 Mar '19

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0292-1 Rating: important References: #1073748 #1109847 #1122191 Cross-References: CVE-2018-14647 CVE-2019-5010 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for python fixes the following issues: Security issues fixed: - CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191). - CVE-2018-14647: Fixed a denial-of-service vulnerability in Expat (bsc#1109847). Non-security issue fixed: - Fixed a bug where PyWeakReference struct was not initialized correctly leading to a crash (bsc#1073748). This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-292=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libpython2_7-1_0-2.7.13-27.12.1 libpython2_7-1_0-debuginfo-2.7.13-27.12.1 python-2.7.13-27.12.1 python-base-2.7.13-27.12.1 python-base-debuginfo-2.7.13-27.12.1 python-base-debugsource-2.7.13-27.12.1 python-curses-2.7.13-27.12.1 python-curses-debuginfo-2.7.13-27.12.1 python-debuginfo-2.7.13-27.12.1 python-debugsource-2.7.13-27.12.1 python-demo-2.7.13-27.12.1 python-devel-2.7.13-27.12.1 python-gdbm-2.7.13-27.12.1 python-gdbm-debuginfo-2.7.13-27.12.1 python-idle-2.7.13-27.12.1 python-tk-2.7.13-27.12.1 python-tk-debuginfo-2.7.13-27.12.1 python-xml-2.7.13-27.12.1 python-xml-debuginfo-2.7.13-27.12.1 - openSUSE Leap 42.3 (noarch): python-doc-2.7.13-27.12.1 python-doc-pdf-2.7.13-27.12.1 - openSUSE Leap 42.3 (x86_64): libpython2_7-1_0-32bit-2.7.13-27.12.1 libpython2_7-1_0-debuginfo-32bit-2.7.13-27.12.1 python-32bit-2.7.13-27.12.1 python-base-32bit-2.7.13-27.12.1 python-base-debuginfo-32bit-2.7.13-27.12.1 python-debuginfo-32bit-2.7.13-27.12.1 References: https://www.suse.com/security/cve/CVE-2018-14647.html https://www.suse.com/security/cve/CVE-2019-5010.html https://bugzilla.suse.com/1073748 https://bugzilla.suse.com/1109847 https://bugzilla.suse.com/1122191 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0293-1: important: Security update for supportutils
by opensuse-security＠opensuse.org 05 Mar '19

05 Mar '19

openSUSE Security Update: Security update for supportutils ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0293-1 Rating: important References: #1043311 #1046681 #1051797 #1071545 #1105849 #1112461 #1115245 #1117776 #1118460 #1118462 #1118463 #1125609 #1125666 Cross-References: CVE-2018-19637 CVE-2018-19638 CVE-2018-19639 CVE-2018-19640 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves four vulnerabilities and has 9 fixes is now available. Description: This update for supportutils fixes the following issues: Security issues fixed: - CVE-2018-19640: Fixed an issue where users could kill arbitrary processes (bsc#1118463). - CVE-2018-19638: Fixed an issue where users could overwrite arbitrary log files (bsc#1118460). - CVE-2018-19639: Fixed a code execution if run with -v (bsc#1118462). - CVE-2018-19637: Fixed an issue where static temporary filename could allow overwriting of files (bsc#1117776). Other issues fixed: - Fixed invalid exit code commands (bsc#1125666). - Included additional SUSE separation (bsc#1125609). - Merged added listing of locked packes by zypper. - Exclude pam.txt per GDPR by default (bsc#1112461). - Clarified -x functionality in supportconfig(8) (bsc#1115245). - udev service and provide the whole journal content in supportconfig (bsc#1051797). - supportconfig collects tuned profile settings (bsc#1071545). - sfdisk -d no disk device specified (bsc#1043311). - Added vulnerabilites status check in basic-health.txt (bsc#1105849). - Added only sched_domain from cpu0. - Blacklist sched_domain from proc.txt (bsc#1046681). - Added firewall-cmd info. - Add ls -lA --time-style=long-iso /etc/products.d/ - Dump lsof errors. - Added corosync status to ha_info. - Dump find errors in ib_info. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-293=1 Package List: - openSUSE Leap 15.0 (noarch): supportutils-3.1-lp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-19637.html https://www.suse.com/security/cve/CVE-2018-19638.html https://www.suse.com/security/cve/CVE-2018-19639.html https://www.suse.com/security/cve/CVE-2018-19640.html https://bugzilla.suse.com/1043311 https://bugzilla.suse.com/1046681 https://bugzilla.suse.com/1051797 https://bugzilla.suse.com/1071545 https://bugzilla.suse.com/1105849 https://bugzilla.suse.com/1112461 https://bugzilla.suse.com/1115245 https://bugzilla.suse.com/1117776 https://bugzilla.suse.com/1118460 https://bugzilla.suse.com/1118462 https://bugzilla.suse.com/1118463 https://bugzilla.suse.com/1125609 https://bugzilla.suse.com/1125666 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0294-1: important: Security update for hiawatha
by opensuse-security＠opensuse.org 05 Mar '19

05 Mar '19

openSUSE Security Update: Security update for hiawatha ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0294-1 Rating: important References: #1125751 Cross-References: CVE-2019-8358 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for hiawatha to version 10.8.4 fixes the following issue: Security issue fixed: - CVE-2019-8358: Fixed a vulnerability which allowed a remote atacker to perform directory traversal when AllowDotFiles was enabled (bsc#1125751). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-294=1 Package List: - openSUSE Leap 15.0 (x86_64): hiawatha-10.8.4-lp150.2.4.1 hiawatha-debuginfo-10.8.4-lp150.2.4.1 hiawatha-debugsource-10.8.4-lp150.2.4.1 hiawatha-letsencrypt-10.8.4-lp150.2.4.1 References: https://www.suse.com/security/cve/CVE-2019-8358.html https://bugzilla.suse.com/1125751 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0291-1: important: Security update for procps
by opensuse-security＠opensuse.org 04 Mar '19

04 Mar '19

openSUSE Security Update: Security update for procps ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0291-1 Rating: important References: #1092100 #1121753 Cross-References: CVE-2018-1122 CVE-2018-1123 CVE-2018-1124 CVE-2018-1125 CVE-2018-1126 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for procps fixes the following security issues: - CVE-2018-1122: Prevent local privilege escalation in top. If a user ran top with HOME unset in an attacker-controlled directory, the attacker could have achieved privilege escalation by exploiting one of several vulnerabilities in the config_file() function (bsc#1092100). - CVE-2018-1123: Prevent denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maped a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service) (bsc#1092100). - CVE-2018-1124: Prevent multiple integer overflows leading to a heap corruption in file2strvec function. This allowed a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users (bsc#1092100). - CVE-2018-1125: Prevent stack buffer overflow in pgrep. This vulnerability was mitigated by FORTIFY limiting the impact to a crash (bsc#1092100). - CVE-2018-1126: Ensure correct integer size in proc/alloc.* to prevent truncation/integer overflow issues (bsc#1092100). (These issues were previously released for SUSE Linux Enterprise 12 SP3 and SP4.) Also the following non-security issue was fixed: - Fix CPU summary showing old data. (bsc#1121753) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-291=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libprocps3-3.3.9-23.1 libprocps3-debuginfo-3.3.9-23.1 procps-3.3.9-23.1 procps-debuginfo-3.3.9-23.1 procps-debugsource-3.3.9-23.1 procps-devel-3.3.9-23.1 References: https://www.suse.com/security/cve/CVE-2018-1122.html https://www.suse.com/security/cve/CVE-2018-1123.html https://www.suse.com/security/cve/CVE-2018-1124.html https://www.suse.com/security/cve/CVE-2018-1125.html https://www.suse.com/security/cve/CVE-2018-1126.html https://bugzilla.suse.com/1092100 https://bugzilla.suse.com/1121753 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0276-1: moderate: Security update for php5
by opensuse-security＠opensuse.org 01 Mar '19

01 Mar '19

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0276-1 Rating: moderate References: #1123354 Cross-References: CVE-2019-6977 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php5 fixes the following issues: Security vulnerability fixed: - CVE-2019-6977: Fixed a heap buffer overflow in gdImageColorMatch in gd_color_match.c (bsc#1123354) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-276=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php5-5.5.14-112.1 apache2-mod_php5-debuginfo-5.5.14-112.1 php5-5.5.14-112.1 php5-bcmath-5.5.14-112.1 php5-bcmath-debuginfo-5.5.14-112.1 php5-bz2-5.5.14-112.1 php5-bz2-debuginfo-5.5.14-112.1 php5-calendar-5.5.14-112.1 php5-calendar-debuginfo-5.5.14-112.1 php5-ctype-5.5.14-112.1 php5-ctype-debuginfo-5.5.14-112.1 php5-curl-5.5.14-112.1 php5-curl-debuginfo-5.5.14-112.1 php5-dba-5.5.14-112.1 php5-dba-debuginfo-5.5.14-112.1 php5-debuginfo-5.5.14-112.1 php5-debugsource-5.5.14-112.1 php5-devel-5.5.14-112.1 php5-dom-5.5.14-112.1 php5-dom-debuginfo-5.5.14-112.1 php5-enchant-5.5.14-112.1 php5-enchant-debuginfo-5.5.14-112.1 php5-exif-5.5.14-112.1 php5-exif-debuginfo-5.5.14-112.1 php5-fastcgi-5.5.14-112.1 php5-fastcgi-debuginfo-5.5.14-112.1 php5-fileinfo-5.5.14-112.1 php5-fileinfo-debuginfo-5.5.14-112.1 php5-firebird-5.5.14-112.1 php5-firebird-debuginfo-5.5.14-112.1 php5-fpm-5.5.14-112.1 php5-fpm-debuginfo-5.5.14-112.1 php5-ftp-5.5.14-112.1 php5-ftp-debuginfo-5.5.14-112.1 php5-gd-5.5.14-112.1 php5-gd-debuginfo-5.5.14-112.1 php5-gettext-5.5.14-112.1 php5-gettext-debuginfo-5.5.14-112.1 php5-gmp-5.5.14-112.1 php5-gmp-debuginfo-5.5.14-112.1 php5-iconv-5.5.14-112.1 php5-iconv-debuginfo-5.5.14-112.1 php5-imap-5.5.14-112.1 php5-imap-debuginfo-5.5.14-112.1 php5-intl-5.5.14-112.1 php5-intl-debuginfo-5.5.14-112.1 php5-json-5.5.14-112.1 php5-json-debuginfo-5.5.14-112.1 php5-ldap-5.5.14-112.1 php5-ldap-debuginfo-5.5.14-112.1 php5-mbstring-5.5.14-112.1 php5-mbstring-debuginfo-5.5.14-112.1 php5-mcrypt-5.5.14-112.1 php5-mcrypt-debuginfo-5.5.14-112.1 php5-mssql-5.5.14-112.1 php5-mssql-debuginfo-5.5.14-112.1 php5-mysql-5.5.14-112.1 php5-mysql-debuginfo-5.5.14-112.1 php5-odbc-5.5.14-112.1 php5-odbc-debuginfo-5.5.14-112.1 php5-opcache-5.5.14-112.1 php5-opcache-debuginfo-5.5.14-112.1 php5-openssl-5.5.14-112.1 php5-openssl-debuginfo-5.5.14-112.1 php5-pcntl-5.5.14-112.1 php5-pcntl-debuginfo-5.5.14-112.1 php5-pdo-5.5.14-112.1 php5-pdo-debuginfo-5.5.14-112.1 php5-pgsql-5.5.14-112.1 php5-pgsql-debuginfo-5.5.14-112.1 php5-phar-5.5.14-112.1 php5-phar-debuginfo-5.5.14-112.1 php5-posix-5.5.14-112.1 php5-posix-debuginfo-5.5.14-112.1 php5-pspell-5.5.14-112.1 php5-pspell-debuginfo-5.5.14-112.1 php5-readline-5.5.14-112.1 php5-readline-debuginfo-5.5.14-112.1 php5-shmop-5.5.14-112.1 php5-shmop-debuginfo-5.5.14-112.1 php5-snmp-5.5.14-112.1 php5-snmp-debuginfo-5.5.14-112.1 php5-soap-5.5.14-112.1 php5-soap-debuginfo-5.5.14-112.1 php5-sockets-5.5.14-112.1 php5-sockets-debuginfo-5.5.14-112.1 php5-sqlite-5.5.14-112.1 php5-sqlite-debuginfo-5.5.14-112.1 php5-suhosin-5.5.14-112.1 php5-suhosin-debuginfo-5.5.14-112.1 php5-sysvmsg-5.5.14-112.1 php5-sysvmsg-debuginfo-5.5.14-112.1 php5-sysvsem-5.5.14-112.1 php5-sysvsem-debuginfo-5.5.14-112.1 php5-sysvshm-5.5.14-112.1 php5-sysvshm-debuginfo-5.5.14-112.1 php5-tidy-5.5.14-112.1 php5-tidy-debuginfo-5.5.14-112.1 php5-tokenizer-5.5.14-112.1 php5-tokenizer-debuginfo-5.5.14-112.1 php5-wddx-5.5.14-112.1 php5-wddx-debuginfo-5.5.14-112.1 php5-xmlreader-5.5.14-112.1 php5-xmlreader-debuginfo-5.5.14-112.1 php5-xmlrpc-5.5.14-112.1 php5-xmlrpc-debuginfo-5.5.14-112.1 php5-xmlwriter-5.5.14-112.1 php5-xmlwriter-debuginfo-5.5.14-112.1 php5-xsl-5.5.14-112.1 php5-xsl-debuginfo-5.5.14-112.1 php5-zip-5.5.14-112.1 php5-zip-debuginfo-5.5.14-112.1 php5-zlib-5.5.14-112.1 php5-zlib-debuginfo-5.5.14-112.1 - openSUSE Leap 42.3 (noarch): php5-pear-5.5.14-112.1 References: https://www.suse.com/security/cve/CVE-2019-6977.html https://bugzilla.suse.com/1123354 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0275-1: important: Security update for kernel-firmware
by opensuse-security＠opensuse.org 01 Mar '19

01 Mar '19

openSUSE Security Update: Security update for kernel-firmware ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0275-1 Rating: important References: #1104301 Cross-References: CVE-2018-5383 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kernel-firmware fixes the following issues: Security issue fixed: - CVE-2018-5383: Fixed an implementation issue in Bluetooth where the eliptic curve parameters were not sufficiently validated during Diffie-Hellman key exchange (bsc#1104301). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-275=1 Package List: - openSUSE Leap 42.3 (noarch): kernel-firmware-20170530-26.1 ucode-amd-20170530-26.1 References: https://www.suse.com/security/cve/CVE-2018-5383.html https://bugzilla.suse.com/1104301 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:0274-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 01 Mar '19

01 Mar '19

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0274-1 Rating: important References: #1012382 #1020413 #1031492 #1042286 #1050549 #1078355 #1086095 #1086652 #1099810 #1103097 #1105428 #1106061 #1106929 #1116345 #1117108 #1117645 #1117744 #1120017 #1120758 #1120902 #1123933 #1124166 #1124732 #1124735 #1124775 #1124777 #1124780 #1124811 #1125000 #1125014 #1125446 #1125794 #1125796 #1125808 #1125809 #1125810 #1125892 #802154 Cross-References: CVE-2018-5391 CVE-2019-3459 CVE-2019-3460 CVE-2019-7221 CVE-2019-7222 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has 33 fixes is now available. Description: The openSUSE Leap 42.3 kernel was updated to 4.4.175 to receive various bugfixes. The following security bugs were fixed: - CVE-2018-5391: Fixed a vulnerability, which allowed an attacker to cause a denial of service attack with low rates of packets targeting IP fragment re-assembly. (bsc#1103097) - CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732). - CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735). The following non-security bugs were fixed: - ASoC: Intel: mrfld: fix uninitialized variable access (bnc#1012382). - ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages (bnc#1012382). - ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M (bnc#1012382). - Documentation/network: reword kernel version reference (bnc#1012382). - IB/core: type promotion bug in rdma_rw_init_one_mr() (). - IB/rxe: Fix incorrect cache cleanup in error flow (). - IB/rxe: replace kvfree with vfree (). - NFC: nxp-nci: Include unaligned.h instead of access_ok.h (bnc#1012382). - RDMA/bnxt_re: Fix a couple off by one bugs (bsc#1020413, ). - RDMA/bnxt_re: Synchronize destroy_qp with poll_cq (bsc#1125446). - Revert "Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G" (bnc#1012382). - Revert "cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs)" (bnc#1012382). - Revert "exec: load_script: do not blindly truncate shebang string" (bnc#1012382). - Revert "loop: Fix double mutex_unlock(&loop_ctl_mutex) in loop_control_ioctl()" (bnc#1012382). - Revert "loop: Fold __loop_release into loop_release" (bnc#1012382). - Revert "loop: Get rid of loop_index_mutex" (bnc#1012382). - Revert "mmc: bcm2835: Fix DMA channel leak on probe error (bsc#1120902)." - Revert most of 4.4.174 (kabi). - acpi, nfit: Fix ARS overflow continuation (bsc#1125000). - acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value (bsc#1124775). - alpha: Fix Eiger NR_IRQS to 128 (bnc#1012382). - alpha: fix page fault handling for r16-r18 targets (bnc#1012382). - alsa: compress: Fix stop handling on compressed capture streams (bnc#1012382). - alsa: hda - Add quirk for HP EliteBook 840 G5 (bnc#1012382). - alsa: hda - Serialize codec registrations (bnc#1012382). - alsa: usb-audio: Fix implicit fb endpoint setup by quirk (bnc#1012382). - arc: perf: map generic branches to correct hardware condition (bnc#1012382). - arm64: KVM: Skip MMIO insn after emulation (bnc#1012382). - arm64: ftrace: do not adjust the LR value (bnc#1012382). - arm64: hyp-stub: Forbid kprobing of the hyp-stub (bnc#1012382). - arm: 8808/1: kexec:offline panic_smp_self_stop CPU (bnc#1012382). - arm: OMAP2+: hwmod: Fix some section annotations (bnc#1012382). - arm: cns3xxx: Fix writing to wrong PCI config registers after alignment (bnc#1012382). - arm: dts: Fix OMAP4430 SDP Ethernet startup (bnc#1012382). - arm: dts: da850-evm: Correct the sound card name (bnc#1012382). - arm: dts: kirkwood: Fix polarity of GPIO fan lines (bnc#1012382). - arm: dts: mmp2: fix TWSI2 (bnc#1012382). - arm: iop32x/n2100: fix PCI IRQ mapping (bnc#1012382). - arm: pxa: avoid section mismatch warning (bnc#1012382). - batman-adv: Avoid WARN on net_device without parent in netns (bnc#1012382). - batman-adv: Force mac header to start of data on xmit (bnc#1012382). - bluetooth: Fix unnecessary error message for HCI request completion (bnc#1012382). - bnxt_re: Fix couple of memory leaks that could lead to IOMMU call traces (bsc#1020413). - can: bcm: check timer values before ktime conversion (bnc#1012382). - can: dev: __can_get_echo_skb(): fix bogous check for non-existing skb by removing it (bnc#1012382). - ceph: clear inode pointer when snap realm gets dropped by its inode (bsc#1125809). - char/mwave: fix potential Spectre v1 vulnerability (bnc#1012382). - cifs: Always resolve hostname before reconnecting (bnc#1012382). - cifs: Do not count -ENODATA as failure for query directory (bnc#1012382). - cifs: Fix possible hang during async MTU reads and writes (bnc#1012382). - cifs: Limit memory used by lock request calls to a page (bnc#1012382). - cifs: check ntwrk_buf_start for NULL before dereferencing it (bnc#1012382). - clk: imx6sl: ensure MMDC CH0 handshake is bypassed (bnc#1012382). - cpufreq: intel_pstate: Fix HWP on boot CPU after system resume (bsc#1120017). - cpuidle: big.LITTLE: fix refcount leak (bnc#1012382). - crypto: ux500 - Use proper enum in cryp_set_dma_transfer (bnc#1012382). - crypto: ux500 - Use proper enum in hash_set_dma_transfer (bnc#1012382). - cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan() (bnc#1012382). - dccp: fool proof ccid_hc_[rt]x_parse_options() (bnc#1012382). - debugfs: fix debugfs_rename parameter checking (bnc#1012382). - dlm: Do not swamp the CPU with callbacks queued during recovery (bnc#1012382). - dm thin: fix bug where bio that overwrites thin block ignores FUA (bnc#1012382). - dmaengine: imx-dma: fix wrong callback invoke (bnc#1012382). - drbd: Avoid Clang warning about pointless switch statment (bnc#1012382). - drbd: disconnect, if the wrong UUIDs are attached on a connected peer (bnc#1012382). - drbd: narrow rcu_read_lock in drbd_sync_handshake (bnc#1012382). - drbd: skip spurious timeout (ping-timeo) when failing promote (bnc#1012382). - drivers: core: Remove glue dirs from sysfs earlier (bnc#1012382). - drm/bufs: Fix Spectre v1 vulnerability (bnc#1012382). - drm/i915: Block fbdev HPD processing during suspend (bsc#1106929) - drm/i915: Prevent a race during I915_GEM_MMAP ioctl with WC set (bsc#1106929) - drm/modes: Prevent division by zero htotal (bnc#1012382). - drm/vmwgfx: Fix setting of dma masks (bsc#1106929) - drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user (bsc#1106929) - enic: fix checksum validation for IPv6 (bnc#1012382). - exec: load_script: do not blindly truncate shebang string (bnc#1012382). - f2fs: fix wrong return value of f2fs_acl_create (bnc#1012382). - f2fs: move dir data flush to write checkpoint process (bnc#1012382). - f2fs: read page index before freeing (bnc#1012382). - fs/dcache: Fix incorrect nr_dentry_unused accounting in shrink_dcache_sb() (bnc#1012382). - fs/epoll: drop ovflist branch prediction (bnc#1012382). - fs: add the fsnotify call to vfs_iter_write (bnc#1012382). - fs: do not scan the inode cache before SB_BORN is set (bnc#1012382). - fs: fix lost error code in dio_complete (bsc#1117744). - fuse: call pipe_buf_release() under pipe lock (bnc#1012382). - fuse: decrement NR_WRITEBACK_TEMP on the right page (bnc#1012382). - fuse: handle zero sized retrieve correctly (bnc#1012382). - futex: Fix (possible) missed wakeup (bsc#1050549). - gdrom: fix a memory leak bug (bnc#1012382). - gfs2: Revert "Fix loop in gfs2_rbm_find" (bnc#1012382). - gpio: pl061: handle failed allocations (bnc#1012382). - gpu: ipu-v3: Fix CSI offsets for imx53 (bsc#1106929) - gpu: ipu-v3: Fix i.MX51 CSI control registers offset (bsc#1106929) - hid: debug: fix the ring buffer implementation (bnc#1012382). - hid: lenovo: Add checks to fix of_led_classdev_register (bnc#1012382). - hwmon: (lm80) Fix missing unlock on error in set_fan_div() (git-fixes). - hwmon: (lm80) fix a missing check of bus read in lm80 probe (bnc#1012382). - hwmon: (lm80) fix a missing check of the status of SMBus read (bnc#1012382). - i2c-axxia: check for error conditions first (bnc#1012382). - igb: Fix an issue that PME is not enabled during runtime suspend (bnc#1012382). - inet: frags: add a pointer to struct netns_frags (bnc#1012382). - inet: frags: better deal with smp races (bnc#1012382). - inet: frags: break the 2GB limit for frags storage (bnc#1012382). - inet: frags: change inet_frags_init_net() return value (bnc#1012382). - inet: frags: do not clone skb in ip_expire() (bnc#1012382). - inet: frags: fix ip6frag_low_thresh boundary (bnc#1012382). - inet: frags: get rid of ipfrag_skb_cb/FRAG_CB (bnc#1012382). - inet: frags: get rif of inet_frag_evicting() (bnc#1012382). - inet: frags: refactor ipfrag_init() (bnc#1012382). - inet: frags: refactor ipv6_frag_init() (bnc#1012382). - inet: frags: refactor lowpan_net_frag_init() (bnc#1012382). - inet: frags: remove inet_frag_maybe_warn_overflow() (bnc#1012382). - inet: frags: remove some helpers (bnc#1012382). - inet: frags: reorganize struct netns_frags (bnc#1012382). - inet: frags: use rhashtables for reassembly units (bnc#1012382). - input: bma150 - register input device after setting private data (bnc#1012382). - input: elan_i2c - add ACPI ID for touchpad in Lenovo V330-15ISK (bnc#1012382). - input: elantech - enable 3rd button support on Fujitsu CELSIUS H780 (bnc#1012382). - input: xpad - add support for SteelSeries Stratus Duo (bnc#1012382). - intel_pstate: Update frequencies of policy->cpus only from ->set_policy() (bsc#1120017). - iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer (bnc#1012382). - ip: add helpers to process in-order fragments faster (bnc#1012382). - ip: frags: fix crash in ip_do_fragment() (bnc#1012382). - ip: process in-order fragments efficiently (bnc#1012382). - ip: use rb trees for IP frag queue (bnc#1012382). - ipfrag: really prevent allocation on netns exit (bnc#1012382). - ipv4: frags: precedence bug in ip_expire() (bnc#1012382). - ipv6: Consider sk_bound_dev_if when binding a socket to an address (bnc#1012382). - ipv6: frags: rewrite ip6_expire_frag_queue() (bnc#1012382). - irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size (bnc#1012382). - isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw() (bnc#1012382). - kABI: protect linux/kfifo.h include in hid-debug (kabi). - kABI: protect struct hda_bus (kabi). - kaweth: use skb_cow_head() to deal with cloned skbs (bnc#1012382). - kernel/exit.c: release ptraced tasks before zap_pid_ns_processes (bnc#1012382). - kernel/hung_task.c: break RCU locks based on jiffies (bnc#1012382). - kvm: VMX: Fix x2apic check in vmx_msr_bitmap_mode() (bsc#1124166). - kvm: VMX: Missing part of upstream commit 904e14fb7cb9 (bsc#1124166). - kvm: x86: Fix single-step debugging (bnc#1012382). - kvm: x86: svm: report MSR_IA32_MCG_EXT_CTL as unsupported (bnc#1012382). - l2tp: copy 4 more bytes to linear part if necessary (bnc#1012382). - l2tp: fix reading optional fields of L2TPv3 (bnc#1012382). - l2tp: remove l2specific_len dependency in l2tp_core (bnc#1012382). - libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive() (bsc#1125810). - libnvdimm, pfn: Pad pfn namespaces relative to other regions (bsc#1124811). - libnvdimm: Use max contiguous area for namespace size (bsc#1124780). - libnvdimm: fix ars_status output length calculation (bsc#1124777). - locking/rwsem: Fix (possible) missed wakeup (bsc#1050549). - mac80211: ensure that mgmt tx skbs have tailroom for encryption (bnc#1012382). - mac80211: fix radiotap vendor presence bitmap handling (bnc#1012382). - media: DaVinci-VPBE: fix error handling in vpbe_initialize() (bnc#1012382). - memstick: Prevent memstick host from getting runtime suspended during card detection (bnc#1012382). - mips: OCTEON: do not set octeon_dma_bar_type if PCI is disabled (bnc#1012382). - mips: VDSO: Include $(ccflags-vdso) in o32,n32 .lds builds (bnc#1012382). - mips: bpf: fix encoding bug for mm_srlv32_op (bnc#1012382). - mips: cm: reprime error cause (bnc#1012382). - misc: vexpress: Off by one in vexpress_syscfg_exec() (bnc#1012382). - mm, oom: fix use-after-free in oom_kill_process (bnc#1012382). - mm, page_alloc: drop should_suppress_show_mem (bnc#1125892, bnc#1106061). - mm: migrate: do not rely on __PageMovable() of newpage after unlocking it (bnc#1012382). - mmc: bcm2835: Fix DMA channel leak on probe error (bsc#1120902). - mmc: sdhci-iproc: handle mmc_of_parse() errors during probe (bnc#1012382). - modpost: validate symbol names also in find_elf_symbol (bnc#1012382). - mtd: rawnand: gpmi: fix MX28 bus master lockup problem (bnc#1012382). - net/mlx4_core: Add masking for a few queries on HCA caps (bnc#1012382). - net/rose: fix NULL ax25_cb kernel panic (bnc#1012382). - net: Fix usage of pskb_trim_rcsum (bnc#1012382). - net: bridge: Fix ethernet header pointer before check skb forwardable (bnc#1012382). - net: dp83640: expire old TX-skb (bnc#1012382). - net: dsa: slave: Do not propagate flag changes on down slave interfaces (bnc#1012382). - net: fix pskb_trim_rcsum_slow() with odd trim offset (bnc#1012382). - net: ieee802154: 6lowpan: fix frag reassembly (bnc#1012382). - net: ipv4: Fix memory leak in network namespace dismantle (bnc#1012382). - net: ipv4: do not handle duplicate fragments as overlapping (bnc#1012382 bsc#1116345). - net: modify skb_rbtree_purge to return the truesize of all purged skbs (bnc#1012382). - net: pskb_trim_rcsum() and CHECKSUM_COMPLETE are friends (bnc#1012382). - net: systemport: Fix WoL with password after deep sleep (bnc#1012382). - net_sched: refetch skb protocol for each filter (bnc#1012382). - netrom: switch to sock timer API (bnc#1012382). - nfit: fix unchecked dereference in acpi_nfit_ctl (bsc#1125014). - nfs: nfs_compare_mount_options always compare auth flavors (bnc#1012382). - nfsd4: fix crash on writing v4_end_grace before nfsd startup (bnc#1012382). - niu: fix missing checks of niu_pci_eeprom_read (bnc#1012382). - ocfs2: do not clear bh uptodate for block read (bnc#1012382). - openvswitch: Avoid OOB read when parsing flow nlattrs (bnc#1012382). - perf tests evsel-tp-sched: Fix bitwise operator (bnc#1012382). - perf tools: Add Hygon Dhyana support (bnc#1012382). - perf unwind: Take pgoff into account when reporting elf to libdwfl (bnc#1012382). - perf unwind: Unwind with libdw does not take symfs into account (bnc#1012382). - perf/core: Do not WARN() for impossible ring-buffer sizes (bnc#1012382). - perf/core: Fix impossible ring-buffer sizes warning (bnc#1012382). - perf/x86/intel/uncore: Add Node ID mask (bnc#1012382). - pinctrl: msm: fix gpio-hog related boot issues (bnc#1012382). - platform/x86: asus-nb-wmi: Drop mapping of 0x33 and 0x34 scan codes (bnc#1012382). - platform/x86: asus-nb-wmi: Map 0x35 to KEY_SCREENLOCK (bnc#1012382). - platform/x86: thinkpad_acpi: Proper model/release matching (bsc#1099810). - powerpc/pseries: add of_node_put() in dlpar_detach_node() (bnc#1012382). - powerpc/uaccess: fix warning/error with access_ok() (bnc#1012382). - ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl (bnc#1012382). - rbd: do not return 0 on unmap if RBD_DEV_FLAG_REMOVING is set (bsc#1125808). - rcu: Force boolean subscript for expedited stall warnings (bnc#1012382). - rhashtable: Add rhashtable_lookup() (bnc#1012382). - rhashtable: add rhashtable_lookup_get_insert_key() (bnc#1012382 bsc#1042286). - rhashtable: add schedule points (bnc#1012382). - rhashtable: reorganize struct rhashtable layout (bnc#1012382). - s390/early: improve machine detection (bnc#1012382). - s390/smp: Fix calling smp_call_ipl_cpu() from ipl CPU (bnc#1012382). - s390/smp: fix CPU hotplug deadlock with CPU rescan (bnc#1012382). - sata_rcar: fix deferred probing (bnc#1012382). - sched/wake_q: Document wake_q_add() (bsc#1050549). - sched/wake_q: Fix wakeup ordering for wake_q (bsc#1050549). - sched/wake_q: Reduce reference counting for special users (bsc#1050549). - scripts/decode_stacktrace: only strip base path when a prefix of the path (bnc#1012382). - scripts/git_sort/git_sort.py: Add mkp/scsi 5.0/scsi-fixes - scsi: lpfc: Correct LCB RJT handling (bnc#1012382). - scsi: lpfc: Correct MDS diag and nvmet configuration (bsc#1125796). - scsi: mpt3sas: API 's to support NVMe drive addition to SML (bsc#1117108). - scsi: mpt3sas: API's to remove nvme drive from sml (bsc#1117108). - scsi: mpt3sas: Add PCI device ID for Andromeda (bsc#1117108). - scsi: mpt3sas: Add an I/O barrier (bsc#1117108). - scsi: mpt3sas: Add ioc_<level> logging macros (bsc#1117108). - scsi: mpt3sas: Add nvme device support in slave alloc, target alloc and probe (bsc#1117108). - scsi: mpt3sas: Add-Task-management-debug-info-for-NVMe-drives (bsc#1117108). - scsi: mpt3sas: Added support for SAS Device Discovery Error Event (bsc#1117108). - scsi: mpt3sas: Added support for nvme encapsulated request message (bsc#1117108). - scsi: mpt3sas: Adding support for SAS3616 HBA device (bsc#1117108). - scsi: mpt3sas: Allow processing of events during driver unload (bsc#1117108). - scsi: mpt3sas: Annotate switch/case fall-through (bsc#1117108). - scsi: mpt3sas: As per MPI-spec, use combined reply queue for SAS3.5 controllers when HBA supports more than 16 MSI-x vectors (bsc#1117108). - scsi: mpt3sas: Bug fix for big endian systems (bsc#1117108). - scsi: mpt3sas: Bump mpt3sas driver version to v16.100.00.00 (bsc#1117108). - scsi: mpt3sas: Cache enclosure pages during enclosure add (bsc#1117108). - scsi: mpt3sas: Configure reply post queue depth, DMA and sgl tablesize (bsc#1117108). - scsi: mpt3sas: Convert logging uses with MPT3SAS_FMT and reply_q_name to %s: (bsc#1117108). - scsi: mpt3sas: Convert logging uses with MPT3SAS_FMT without logging levels (bsc#1117108). - scsi: mpt3sas: Convert mlsleading uses of pr_<level> with MPT3SAS_FMT (bsc#1117108). - scsi: mpt3sas: Convert uses of pr_<level> with MPT3SAS_FMT to ioc_<level> (bsc#1117108). - scsi: mpt3sas: Display chassis slot information of the drive (bsc#1117108). - scsi: mpt3sas: Do not abort I/Os issued to NVMe drives while processing Async Broadcast primitive event (bsc#1117108). - scsi: mpt3sas: Do not access the structure after decrementing it's instance reference count (bsc#1117108). - scsi: mpt3sas: Do not use 32-bit atomic request descriptor for Ventura controllers (bsc#1117108). - scsi: mpt3sas: Enhanced handling of Sense Buffer (bsc#1117108). - scsi: mpt3sas: Fix a race condition in mpt3sas_base_hard_reset_handler() (bsc#1117108). - scsi: mpt3sas: Fix calltrace observed while running IO & reset (bsc#1117108). - scsi: mpt3sas: Fix indentation (bsc#1117108). - scsi: mpt3sas: Fix memory allocation failure test in 'mpt3sas_base_attach()' (bsc#1117108). - scsi: mpt3sas: Fix nvme drives checking for tlr (bsc#1117108). - scsi: mpt3sas: Fix possibility of using invalid Enclosure Handle for SAS device after host reset (bsc#1117108). - scsi: mpt3sas: Fix removal and addition of vSES device during host reset (bsc#1117108). - scsi: mpt3sas: Fix sparse warnings (bsc#1117108). - scsi: mpt3sas: Fix, False timeout prints for ioctl and other internal commands during controller reset (bsc#1117108). - scsi: mpt3sas: Fixed memory leaks in driver (bsc#1117108). - scsi: mpt3sas: For NVME device, issue a protocol level reset (bsc#1117108). - scsi: mpt3sas: Handle NVMe PCIe device related events generated from firmware (bsc#1117108). - scsi: mpt3sas: Improve kernel-doc headers (bsc#1117108). - scsi: mpt3sas: Incorrect command status was set/marked as not used (bsc#1117108). - scsi: mpt3sas: Increase event log buffer to support 24 port HBA's (bsc#1117108). - scsi: mpt3sas: Introduce API to get BAR0 mapped buffer address (bsc#1117108). - scsi: mpt3sas: Introduce Base function for cloning (bsc#1117108). - scsi: mpt3sas: Introduce function to clone mpi reply (bsc#1117108). - scsi: mpt3sas: Introduce function to clone mpi request (bsc#1117108). - scsi: mpt3sas: Introduce mpt3sas_get_st_from_smid() (bsc#1117108). - scsi: mpt3sas: Introduce struct mpt3sas_nvme_cmd (bsc#1117108). - scsi: mpt3sas: Lockless access for chain buffers (bsc#1117108). - scsi: mpt3sas: NVMe drive support for BTDHMAPPING ioctl command and log info (bsc#1117108). - scsi: mpt3sas: Optimize I/O memory consumption in driver (bsc#1117108). - scsi: mpt3sas: Pre-allocate RDPQ Array at driver boot time (bsc#1117108). - scsi: mpt3sas: Processing of Cable Exception events (bsc#1117108). - scsi: mpt3sas: Reduce memory footprint in kdump kernel (bsc#1117108). - scsi: mpt3sas: Remove KERN_WARNING from panic uses (bsc#1117108). - scsi: mpt3sas: Remove set-but-not-used variables (bsc#1117108). - scsi: mpt3sas: Remove unnecessary parentheses and simplify null checks (bsc#1117108). - scsi: mpt3sas: Remove unused macro MPT3SAS_FMT (bsc#1117108). - scsi: mpt3sas: Remove unused variable requeue_event (bsc#1117108). - scsi: mpt3sas: Replace PCI pool old API (bsc#1117108). - scsi: mpt3sas: Replace PCI pool old API (bsc#1117108). - scsi: mpt3sas: Report Firmware Package Version from HBA Driver (bsc#1117108). - scsi: mpt3sas: SGL to PRP Translation for I/Os to NVMe devices (bsc#1117108). - scsi: mpt3sas: Set NVMe device queue depth as 128 (bsc#1117108). - scsi: mpt3sas: Split _base_reset_handler(), mpt3sas_scsih_reset_handler() and mpt3sas_ctl_reset_handler() (bsc#1117108). - scsi: mpt3sas: Swap I/O memory read value back to cpu endianness (bsc#1117108). - scsi: mpt3sas: Update MPI Headers (bsc#1117108). - scsi: mpt3sas: Update driver version "25.100.00.00" (bsc#1117108). - scsi: mpt3sas: Update driver version "26.100.00.00" (bsc#1117108). - scsi: mpt3sas: Update mpt3sas driver version (bsc#1117108). - scsi: mpt3sas: Updated MPI headers to v2.00.48 (bsc#1117108). - scsi: mpt3sas: Use dma_pool_zalloc (bsc#1117108). - scsi: mpt3sas: always use first reserved smid for ioctl passthrough (bsc#1117108). - scsi: mpt3sas: check command status before attempting abort (bsc#1117108). - scsi: mpt3sas: clarify mmio pointer types (bsc#1117108). - scsi: mpt3sas: cleanup _scsih_pcie_enumeration_event() (bsc#1117108). - scsi: mpt3sas: fix an out of bound write (bsc#1117108). - scsi: mpt3sas: fix dma_addr_t casts (bsc#1117108). - scsi: mpt3sas: fix format overflow warning (bsc#1117108). - scsi: mpt3sas: fix oops in error handlers after shutdown/unload (bsc#1117108). - scsi: mpt3sas: fix possible memory leak (bsc#1117108). - scsi: mpt3sas: fix pr_info message continuation (bsc#1117108). - scsi: mpt3sas: fix spelling mistake: "disbale" -> "disable" (bsc#1117108). - scsi: mpt3sas: lockless command submission (bsc#1117108). - scsi: mpt3sas: make function _get_st_from_smid static (bsc#1117108). - scsi: mpt3sas: open-code _scsih_scsi_lookup_get() (bsc#1117108). - scsi: mpt3sas: remove a stray KERN_INFO (bsc#1117108). - scsi: mpt3sas: remove redundant copy_from_user in _ctl_getiocinfo (bsc#1117108). - scsi: mpt3sas: remove redundant wmb (bsc#1117108). - scsi: mpt3sas: scan and add nvme device after controller reset (bsc#1117108). - scsi: mpt3sas: separate out _base_recovery_check() (bsc#1117108). - scsi: mpt3sas: set default value for cb_idx (bsc#1117108). - scsi: mpt3sas: simplify _wait_for_commands_to_complete() (bsc#1117108). - scsi: mpt3sas: simplify mpt3sas_scsi_issue_tm() (bsc#1117108). - scsi: mpt3sas: simplify task management functions (bsc#1117108). - scsi: mpt3sas: switch to generic DMA API (bsc#1117108). - scsi: mpt3sas: switch to pci_alloc_irq_vectors (bsc#1117108). - scsi: mpt3sas: use list_splice_init() (bsc#1117108). - scsi: mpt3sas: wait for and flush running commands on shutdown/unload (bsc#1117108). - scsi: qla2xxx: Fix deadlock between ATIO and HW lock (bsc#1125794). - scsi: target: make the pi_prot_format ConfigFS path readable (bsc#1123933). - sd: disable logical block provisioning if 'lbpme' is not set (bsc#1086095 bsc#1078355). - seq_buf: Make seq_buf_puts() null-terminate the buffer (bnc#1012382). - serial: fsl_lpuart: clear parity enable bit when disable parity (bnc#1012382). - signal: Always notice exiting tasks (bnc#1012382). - signal: Better detection of synchronous signals (bnc#1012382). - signal: Restore the stop PTRACE_EVENT_EXIT (bnc#1012382). - skge: potential memory corruption in skge_get_regs() (bnc#1012382). - smack: fix access permissions for keyring (bnc#1012382). - smsc95xx: Use skb_cow_head to deal with cloned skbs (bnc#1012382). - soc/tegra: Do not leak device tree node reference (bnc#1012382). - staging: iio: ad7780: update voltage on read (bnc#1012382). - staging: iio: adc: ad7280a: handle error from __ad7280_read32() (bnc#1012382). - staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1 (bnc#1012382). - staging:iio:ad2s90: Make probe handle spi_setup failure (bnc#1012382). - sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN (bnc#1012382). - test_hexdump: use memcpy instead of strncpy (bnc#1012382). - thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set (bnc#1012382). - timekeeping: Use proper seqcount initializer (bnc#1012382). - tipc: use destination length for copy string (bnc#1012382). - tracing/uprobes: Fix output for multiple string arguments (bnc#1012382). - tty/ldsem: Add lockdep asserts for ldisc_sem (bnc#1105428). - tty/ldsem: Convert to regular lockdep annotations (bnc#1105428). - tty/ldsem: Decrement wait_readers on timeouted down_read() (bnc#1105428). - tty/n_hdlc: fix __might_sleep warning (bnc#1012382). - tty: Do not block on IO when ldisc change is pending (bnc#1105428). - tty: Do not hold ldisc lock in tty_reopen() if ldisc present (bnc#1105428). - tty: Handle problem if line discipline does not have receive_buf (bnc#1012382). - tty: Hold tty_ldisc_lock() during tty_reopen() (bnc#1105428). - tty: Simplify tty->count math in tty_reopen() (bnc#1105428). - tty: fix data race between tty_init_dev and flush of buf (bnc#1105428). - tty: serial: samsung: Properly set flags in autoCTS mode (bnc#1012382). - uapi/if_ether.h: move __UAPI_DEF_ETHHDR libc define (bnc#1012382). - uapi/if_ether.h: prevent redefinition of struct ethhdr (bnc#1012382). - ucc_geth: Reset BQL queue when stopping device (bnc#1012382). - udf: Fix BUG on corrupted inode (bnc#1012382). - um: Avoid marking pages with "changed protection" (bnc#1012382). - usb: dwc2: Remove unnecessary kfree (bnc#1012382). - usb: gadget: udc: net2272: Fix bitwise and boolean operations (bnc#1012382). - usb: hub: delay hub autosuspend if USB3 port is still link training (bnc#1012382). - usb: phy: am335x: fix race condition in _probe (bnc#1012382). - usb: serial: pl2303: add new PID to support PL2303TB (bnc#1012382). - usb: serial: simple: add Motorola Tetra TPG2200 device id (bnc#1012382). - video: clps711x-fb: release disp device node in probe() (bnc#1012382). - vt: invoke notifier on screen size change (bnc#1012382). - x86/MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out() (bnc#1012382). - x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux) (bnc#1012382). - x86/a.out: Clear the dump structure initially (bnc#1012382). - x86/fpu: Add might_fault() to user_insn() (bnc#1012382). - x86/kaslr: Fix incorrect i8254 outb() parameters (bnc#1012382). - x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls (bnc#1012382). - x86/xen: dont add memory above max allowed allocation (bsc#1117645). - x86: respect memory size limiting via mem= parameter (bsc#1117645). - xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi (bnc#1012382). - xfrm: refine validation of template and selector families (bnc#1012382). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-274=1 Package List: - openSUSE Leap 42.3 (noarch): kernel-devel-4.4.175-89.1 kernel-docs-4.4.175-89.1 kernel-docs-html-4.4.175-89.1 kernel-docs-pdf-4.4.175-89.1 kernel-macros-4.4.175-89.1 kernel-source-4.4.175-89.1 kernel-source-vanilla-4.4.175-89.1 - openSUSE Leap 42.3 (x86_64): kernel-debug-4.4.175-89.1 kernel-debug-base-4.4.175-89.1 kernel-debug-base-debuginfo-4.4.175-89.1 kernel-debug-debuginfo-4.4.175-89.1 kernel-debug-debugsource-4.4.175-89.1 kernel-debug-devel-4.4.175-89.1 kernel-debug-devel-debuginfo-4.4.175-89.1 kernel-default-4.4.175-89.1 kernel-default-base-4.4.175-89.1 kernel-default-base-debuginfo-4.4.175-89.1 kernel-default-debuginfo-4.4.175-89.1 kernel-default-debugsource-4.4.175-89.1 kernel-default-devel-4.4.175-89.1 kernel-obs-build-4.4.175-89.1 kernel-obs-build-debugsource-4.4.175-89.1 kernel-obs-qa-4.4.175-89.1 kernel-syms-4.4.175-89.1 kernel-vanilla-4.4.175-89.1 kernel-vanilla-base-4.4.175-89.1 kernel-vanilla-base-debuginfo-4.4.175-89.1 kernel-vanilla-debuginfo-4.4.175-89.1 kernel-vanilla-debugsource-4.4.175-89.1 kernel-vanilla-devel-4.4.175-89.1 References: https://www.suse.com/security/cve/CVE-2018-5391.html https://www.suse.com/security/cve/CVE-2019-3459.html https://www.suse.com/security/cve/CVE-2019-3460.html https://www.suse.com/security/cve/CVE-2019-7221.html https://www.suse.com/security/cve/CVE-2019-7222.html https://bugzilla.suse.com/1012382 https://bugzilla.suse.com/1020413 https://bugzilla.suse.com/1031492 https://bugzilla.suse.com/1042286 https://bugzilla.suse.com/1050549 https://bugzilla.suse.com/1078355 https://bugzilla.suse.com/1086095 https://bugzilla.suse.com/1086652 https://bugzilla.suse.com/1099810 https://bugzilla.suse.com/1103097 https://bugzilla.suse.com/1105428 https://bugzilla.suse.com/1106061 https://bugzilla.suse.com/1106929 https://bugzilla.suse.com/1116345 https://bugzilla.suse.com/1117108 https://bugzilla.suse.com/1117645 https://bugzilla.suse.com/1117744 https://bugzilla.suse.com/1120017 https://bugzilla.suse.com/1120758 https://bugzilla.suse.com/1120902 https://bugzilla.suse.com/1123933 https://bugzilla.suse.com/1124166 https://bugzilla.suse.com/1124732 https://bugzilla.suse.com/1124735 https://bugzilla.suse.com/1124775 https://bugzilla.suse.com/1124777 https://bugzilla.suse.com/1124780 https://bugzilla.suse.com/1124811 https://bugzilla.suse.com/1125000 https://bugzilla.suse.com/1125014 https://bugzilla.suse.com/1125446 https://bugzilla.suse.com/1125794 https://bugzilla.suse.com/1125796 https://bugzilla.suse.com/1125808 https://bugzilla.suse.com/1125809 https://bugzilla.suse.com/1125810 https://bugzilla.suse.com/1125892 https://bugzilla.suse.com/802154 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0