April 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:1108-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1108-1 Rating: moderate References: #1127367 #1127369 #1127370 Cross-References: CVE-2019-9208 CVE-2019-9209 CVE-2019-9214 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for wireshark to version 2.4.13 fixes the following issues: Security issues fixed: - CVE-2019-9214: Avoided a dereference of a null coversation which could make RPCAP dissector crash (bsc#1127367). - CVE-2019-9209: Fixed a buffer overflow in time values which could make ASN.1 BER and related dissectors crash (bsc#1127369). - CVE-2019-9208: Fixed a null pointer dereference which could make TCAP dissector crash (bsc#1127370). Release notes: https://www.wireshark.org/docs/relnotes/wireshark-2.4.13.html This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1108=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libwireshark9-2.4.13-lp150.2.23.1 libwireshark9-debuginfo-2.4.13-lp150.2.23.1 libwiretap7-2.4.13-lp150.2.23.1 libwiretap7-debuginfo-2.4.13-lp150.2.23.1 libwscodecs1-2.4.13-lp150.2.23.1 libwscodecs1-debuginfo-2.4.13-lp150.2.23.1 libwsutil8-2.4.13-lp150.2.23.1 libwsutil8-debuginfo-2.4.13-lp150.2.23.1 wireshark-2.4.13-lp150.2.23.1 wireshark-debuginfo-2.4.13-lp150.2.23.1 wireshark-debugsource-2.4.13-lp150.2.23.1 wireshark-devel-2.4.13-lp150.2.23.1 wireshark-ui-qt-2.4.13-lp150.2.23.1 wireshark-ui-qt-debuginfo-2.4.13-lp150.2.23.1 References: https://www.suse.com/security/cve/CVE-2019-9208.html https://www.suse.com/security/cve/CVE-2019-9209.html https://www.suse.com/security/cve/CVE-2019-9214.html https://bugzilla.suse.com/1127367 https://bugzilla.suse.com/1127369 https://bugzilla.suse.com/1127370 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1111-1: important: Security update for openwsman
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for openwsman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1111-1 Rating: important References: #1092206 #1122623 Cross-References: CVE-2019-3816 CVE-2019-3833 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openwsman fixes the following issues: Security issues fixed: - CVE-2019-3816: Fixed a vulnerability in openwsmand deamon which could lead to arbitary file disclosure (bsc#1122623). - CVE-2019-3833: Fixed a vulnerability in process_connection() which could allow an attacker to trigger an infinite loop which leads to Denial of Service (bsc#1122623). Other issues addressed: - Added OpenSSL 1.1 compatibility - Compilation in debug mode fixed - Directory listing without authentication fixed (bsc#1092206). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1111=1 Package List: - openSUSE Leap 15.0 (x86_64): libwsman-devel-2.6.7-lp150.2.3.1 libwsman3-2.6.7-lp150.2.3.1 libwsman3-debuginfo-2.6.7-lp150.2.3.1 libwsman_clientpp-devel-2.6.7-lp150.2.3.1 libwsman_clientpp1-2.6.7-lp150.2.3.1 libwsman_clientpp1-debuginfo-2.6.7-lp150.2.3.1 openwsman-debuginfo-2.6.7-lp150.2.3.1 openwsman-debugsource-2.6.7-lp150.2.3.1 openwsman-java-2.6.7-lp150.2.3.1 openwsman-perl-2.6.7-lp150.2.3.1 openwsman-perl-debuginfo-2.6.7-lp150.2.3.1 openwsman-ruby-2.6.7-lp150.2.3.1 openwsman-ruby-debuginfo-2.6.7-lp150.2.3.1 openwsman-ruby-docs-2.6.7-lp150.2.3.1 openwsman-server-2.6.7-lp150.2.3.1 openwsman-server-debuginfo-2.6.7-lp150.2.3.1 openwsman-server-plugin-ruby-2.6.7-lp150.2.3.1 openwsman-server-plugin-ruby-debuginfo-2.6.7-lp150.2.3.1 python3-openwsman-2.6.7-lp150.2.3.1 python3-openwsman-debuginfo-2.6.7-lp150.2.3.1 winrs-2.6.7-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-3816.html https://www.suse.com/security/cve/CVE-2019-3833.html https://bugzilla.suse.com/1092206 https://bugzilla.suse.com/1122623 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1120-1: moderate: Security update for libgxps
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for libgxps ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1120-1 Rating: moderate References: #1092125 Cross-References: CVE-2018-10733 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libgxps fixes the following issues: - CVE-2018-10733: Fixed a heap-based buffer over-read issue in ft_font_face_hash (bsc#1092125). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1120=1 Package List: - openSUSE Leap 15.0 (x86_64): libgxps-debuginfo-0.3.0-lp150.3.3.2 libgxps-debugsource-0.3.0-lp150.3.3.2 libgxps-devel-0.3.0-lp150.3.3.2 libgxps-tools-0.3.0-lp150.3.3.2 libgxps-tools-debuginfo-0.3.0-lp150.3.3.2 libgxps2-0.3.0-lp150.3.3.2 libgxps2-debuginfo-0.3.0-lp150.3.3.2 typelib-1_0-GXPS-0_1-0.3.0-lp150.3.3.2 References: https://www.suse.com/security/cve/CVE-2018-10733.html https://bugzilla.suse.com/1092125 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1113-1: moderate: Security update for putty
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for putty ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1113-1 Rating: moderate References: #1129633 Cross-References: CVE-2019-9894 CVE-2019-9895 CVE-2019-9896 CVE-2019-9897 CVE-2019-9898 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for putty fixes the following issues: Update to new upstream release 0.71 [boo#1129633] * CVE-2019-9894: Fixed a remotely triggerable memory overwrite in RSA key exchange, which can occur before host key verification potential recycling of random numbers used in cryptography. * CVE-2019-9895: Fixed a remotely triggerable buffer overflow in any kind of server-to-client forwarding. * CVE-2019-9897: Fixed multiple denial-of-service attacks that can be triggered by writing to the terminal. * CVE-2019-9898: Fixed potential recycling of random numbers used in cryptography * CVE-2019-9896 (Windows only): Fixed hijacking by a malicious help file in the same directory as the executable * Major rewrite of the crypto code to remove cache and timing side channels. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1113=1 Package List: - openSUSE Leap 15.0 (x86_64): putty-0.71-lp150.9.1 putty-debuginfo-0.71-lp150.9.1 putty-debugsource-0.71-lp150.9.1 References: https://www.suse.com/security/cve/CVE-2019-9894.html https://www.suse.com/security/cve/CVE-2019-9895.html https://www.suse.com/security/cve/CVE-2019-9896.html https://www.suse.com/security/cve/CVE-2019-9897.html https://www.suse.com/security/cve/CVE-2019-9898.html https://bugzilla.suse.com/1129633 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1109-1: moderate: Security update for libssh2_org
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for libssh2_org ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1109-1 Rating: moderate References: #1128471 #1128472 #1128474 #1128476 #1128480 #1128481 #1128490 #1128492 #1128493 Cross-References: CVE-2019-3855 CVE-2019-3856 CVE-2019-3857 CVE-2019-3858 CVE-2019-3859 CVE-2019-3860 CVE-2019-3861 CVE-2019-3862 CVE-2019-3863 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for libssh2_org fixes the following issues: Security issues fixed: - CVE-2019-3861: Fixed Out-of-bounds reads with specially crafted SSH packets (bsc#1128490). - CVE-2019-3862: Fixed Out-of-bounds memory comparison with specially crafted message channel request packet (bsc#1128492). - CVE-2019-3860: Fixed Out-of-bounds reads with specially crafted SFTP packets (bsc#1128481). - CVE-2019-3863: Fixed an Integer overflow in user authenicate keyboard interactive which could allow out-of-bounds writes with specially crafted keyboard responses (bsc#1128493). - CVE-2019-3856: Fixed a potential Integer overflow in keyboard interactive handling which could allow out-of-bounds write with specially crafted payload (bsc#1128472). - CVE-2019-3859: Fixed Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev (bsc#1128480). - CVE-2019-3855: Fixed a potential Integer overflow in transport read which could allow out-of-bounds write with specially crafted payload (bsc#1128471). - CVE-2019-3858: Fixed a potential zero-byte allocation which could lead to an out-of-bounds read with a specially crafted SFTP packet (bsc#1128476). - CVE-2019-3857: Fixed a potential Integer overflow which could lead to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet (bsc#1128474). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1109=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libssh2-1-1.8.0-lp150.3.3.1 libssh2-1-debuginfo-1.8.0-lp150.3.3.1 libssh2-devel-1.8.0-lp150.3.3.1 libssh2_org-debugsource-1.8.0-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): libssh2-1-32bit-1.8.0-lp150.3.3.1 libssh2-1-32bit-debuginfo-1.8.0-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-3855.html https://www.suse.com/security/cve/CVE-2019-3856.html https://www.suse.com/security/cve/CVE-2019-3857.html https://www.suse.com/security/cve/CVE-2019-3858.html https://www.suse.com/security/cve/CVE-2019-3859.html https://www.suse.com/security/cve/CVE-2019-3860.html https://www.suse.com/security/cve/CVE-2019-3861.html https://www.suse.com/security/cve/CVE-2019-3862.html https://www.suse.com/security/cve/CVE-2019-3863.html https://bugzilla.suse.com/1128471 https://bugzilla.suse.com/1128472 https://bugzilla.suse.com/1128474 https://bugzilla.suse.com/1128476 https://bugzilla.suse.com/1128480 https://bugzilla.suse.com/1128481 https://bugzilla.suse.com/1128490 https://bugzilla.suse.com/1128492 https://bugzilla.suse.com/1128493 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1115-1: moderate: Security update for libqt5-qtimageformats
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for libqt5-qtimageformats ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1115-1 Rating: moderate References: #1118598 Cross-References: CVE-2018-19871 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libqt5-qtimageformats fixes the following issues: Security issues fixed: - CVE-2018-19871: Fixed CPU exhaustion in QTgaFile (bsc#1118598) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1115=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libqt5-qtimageformats-5.9.4-lp150.2.3.2 libqt5-qtimageformats-debuginfo-5.9.4-lp150.2.3.2 libqt5-qtimageformats-debugsource-5.9.4-lp150.2.3.2 libqt5-qtimageformats-devel-5.9.4-lp150.2.3.2 - openSUSE Leap 15.0 (x86_64): libqt5-qtimageformats-32bit-5.9.4-lp150.2.3.2 libqt5-qtimageformats-32bit-debuginfo-5.9.4-lp150.2.3.2 References: https://www.suse.com/security/cve/CVE-2018-19871.html https://bugzilla.suse.com/1118598 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1106-1: important: Security update for python-azure-agent
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for python-azure-agent ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1106-1 Rating: important References: #1127838 Cross-References: CVE-2019-0804 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-azure-agent fixes the following issues: - CVE-2019-0804: An issue with swapfile handling in the agent created a data leak situation that exposes system memory data. (bsc#1127838) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1106=1 Package List: - openSUSE Leap 15.0 (noarch): python-azure-agent-2.2.36-lp150.5.10.1 python-azure-agent-test-2.2.36-lp150.5.10.1 References: https://www.suse.com/security/cve/CVE-2019-0804.html https://bugzilla.suse.com/1127838 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1089-1: moderate: Security update for yast2-rmt
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for yast2-rmt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1089-1 Rating: moderate References: #1119835 #1120672 #1123562 Cross-References: CVE-2018-20105 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for yast2-rmt to 1.2.2 fixes the following issues: Security issue fixed: - CVE-2018-20105: Pass SSL password to Cheetah CLI interface securely (bsc#1119835) Non-security issues fixed: - Launch as root from gnome-shell menu (bsc#1123562) - Remove broken hyperlink from help (bsc#1120672) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1089=1 Package List: - openSUSE Leap 15.0 (noarch): yast2-rmt-1.2.2-lp150.2.19.1 References: https://www.suse.com/security/cve/CVE-2018-20105.html https://bugzilla.suse.com/1119835 https://bugzilla.suse.com/1120672 https://bugzilla.suse.com/1123562 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0