April 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:1112-1: Security update for python-Flask
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for python-Flask ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1112-1 Rating: low References: #1106279 Cross-References: CVE-2018-1000656 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Flask to version 0.12.4 fixes the following issues: Security issue fixed: - CVE-2018-1000656: Fixed an improper input validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. (bsc#1106279) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1112=1 Package List: - openSUSE Leap 15.0 (noarch): python2-Flask-0.12.4-lp150.2.3.1 python2-Flask-doc-0.12.4-lp150.2.3.1 python3-Flask-0.12.4-lp150.2.3.1 python3-Flask-doc-0.12.4-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000656.html https://bugzilla.suse.com/1106279 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1107-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1107-1 Rating: moderate References: #1126340 Cross-References: CVE-2019-8955 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tor to version 0.3.4.11 fixes the following issues: Security issue fixed: - CVE-2019-8955: Fixed a vulnerability in the KIST cell scheduler which could lead to memory exhaustion and finally Denial-of-Service (bsc#1126340). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1107=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1107=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1107=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1107=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): tor-0.3.4.11-21.1 tor-debuginfo-0.3.4.11-21.1 tor-debugsource-0.3.4.11-21.1 - openSUSE Leap 15.0 (x86_64): tor-0.3.4.11-lp150.22.1 tor-debuginfo-0.3.4.11-lp150.22.1 tor-debugsource-0.3.4.11-lp150.22.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): tor-0.3.4.11-bp150.3.6.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): tor-0.3.4.11-20.1 References: https://www.suse.com/security/cve/CVE-2019-8955.html https://bugzilla.suse.com/1126340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1118-1: moderate: Security update for libjpeg-turbo
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for libjpeg-turbo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1118-1 Rating: moderate References: #1096209 #1098155 #1128712 Cross-References: CVE-2018-1152 CVE-2018-11813 CVE-2018-14498 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libjpeg-turbo fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-14498: Fixed a heap-based buffer over read in get_8bit_row function which could allow to an attacker to cause denial of service (bsc#1128712). - CVE-2018-11813: Fixed the end-of-file mishandling in read_pixel in rdtarga.c, which allowed remote attackers to cause a denial-of-service via crafted JPG files due to a large loop (bsc#1096209) - CVE-2018-1152: Fixed a denial of service in start_input_bmp() rdbmp.c caused by a divide by zero when processing a crafted BMP image (bsc#1098155) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1118=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libjpeg-turbo-1.5.3-lp150.4.3.2 libjpeg-turbo-debuginfo-1.5.3-lp150.4.3.2 libjpeg-turbo-debugsource-1.5.3-lp150.4.3.2 libjpeg62-62.2.0-lp150.4.3.2 libjpeg62-debuginfo-62.2.0-lp150.4.3.2 libjpeg62-devel-62.2.0-lp150.4.3.2 libjpeg62-turbo-1.5.3-lp150.4.3.2 libjpeg62-turbo-debugsource-1.5.3-lp150.4.3.2 libjpeg8-8.1.2-lp150.4.3.2 libjpeg8-debuginfo-8.1.2-lp150.4.3.2 libjpeg8-devel-8.1.2-lp150.4.3.2 libturbojpeg0-8.1.2-lp150.4.3.2 libturbojpeg0-debuginfo-8.1.2-lp150.4.3.2 - openSUSE Leap 15.0 (x86_64): libjpeg62-32bit-62.2.0-lp150.4.3.2 libjpeg62-32bit-debuginfo-62.2.0-lp150.4.3.2 libjpeg62-devel-32bit-62.2.0-lp150.4.3.2 libjpeg8-32bit-8.1.2-lp150.4.3.2 libjpeg8-32bit-debuginfo-8.1.2-lp150.4.3.2 libjpeg8-devel-32bit-8.1.2-lp150.4.3.2 libturbojpeg0-32bit-8.1.2-lp150.4.3.2 libturbojpeg0-32bit-debuginfo-8.1.2-lp150.4.3.2 References: https://www.suse.com/security/cve/CVE-2018-1152.html https://www.suse.com/security/cve/CVE-2018-11813.html https://www.suse.com/security/cve/CVE-2018-14498.html https://bugzilla.suse.com/1096209 https://bugzilla.suse.com/1098155 https://bugzilla.suse.com/1128712 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1104-1: important: Security update for python-cryptography, python-pyOpenSSL
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for python-cryptography, python-pyOpenSSL ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1104-1 Rating: important References: #1021578 #1052927 #1111634 #1111635 #1119077 Cross-References: CVE-2018-1000807 CVE-2018-1000808 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for python-cryptography, python-pyOpenSSL fixes the following issues: Security issues fixed: - CVE-2018-1000808: A memory leak due to missing reference checking in PKCS#12 store handling was fixed (bsc#1111634) - CVE-2018-1000807: A use-after-free in X509 object handling was fixed (bsc#1111635) This update also contains the following tracked bug fixes: - avoid bad interaction with python-cryptography package. (bsc#1021578) - Avoid regression accessesing non-existing attribute _from_raw_x509_ptr in object X509 (bsc#1119077) - Add python-setuptools as a requirement. (bsc#1052927) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1104=1 Package List: - openSUSE Leap 42.3 (noarch): python-pyOpenSSL-16.0.0-5.8.2 python-pyOpenSSL-doc-16.0.0-5.8.2 python3-pyOpenSSL-16.0.0-5.8.2 python3-pyOpenSSL-doc-16.0.0-5.8.2 - openSUSE Leap 42.3 (x86_64): python-cryptography-1.3.1-5.3.1 python-cryptography-debuginfo-1.3.1-5.3.1 python-cryptography-debugsource-1.3.1-5.3.1 python3-cryptography-1.3.1-5.3.1 python3-cryptography-debuginfo-1.3.1-5.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000807.html https://www.suse.com/security/cve/CVE-2018-1000808.html https://bugzilla.suse.com/1021578 https://bugzilla.suse.com/1052927 https://bugzilla.suse.com/1111634 https://bugzilla.suse.com/1111635 https://bugzilla.suse.com/1119077 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1107-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1107-1 Rating: moderate References: #1126340 Cross-References: CVE-2019-8955 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tor to version 0.3.4.11 fixes the following issues: Security issue fixed: - CVE-2019-8955: Fixed a vulnerability in the KIST cell scheduler which could lead to memory exhaustion and finally Denial-of-Service (bsc#1126340). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1107=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1107=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1107=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): tor-0.3.4.11-21.1 tor-debuginfo-0.3.4.11-21.1 tor-debugsource-0.3.4.11-21.1 - openSUSE Leap 15.0 (x86_64): tor-0.3.4.11-lp150.22.1 tor-debuginfo-0.3.4.11-lp150.22.1 tor-debugsource-0.3.4.11-lp150.22.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): tor-0.3.4.11-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-8955.html https://bugzilla.suse.com/1126340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1114-1: important: Security update for perl-Email-Address
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for perl-Email-Address ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1114-1 Rating: important References: #1098368 Cross-References: CVE-2018-12558 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for perl-Email-Address to version 1.912 fixes the following issue: Security issue fixed: - CVE-2018-12558: Fixed a vulnerability which could allow Denial of Service in perl module Email::Address (bsc#1098368). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1114=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1114=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1114=1 Package List: - openSUSE Leap 42.3 (noarch): perl-Email-Address-1.912-5.3.1 - openSUSE Leap 15.0 (noarch): perl-Email-Address-1.912-lp150.2.3.1 - openSUSE Backports SLE-15 (noarch): perl-Email-Address-1.912-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-12558.html https://bugzilla.suse.com/1098368 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1119-1: important: Security update for ghostscript
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1119-1 Rating: important References: #1129186 Cross-References: CVE-2019-3838 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ghostscript fixes the following issue: Security issue fixed: - CVE-2019-3838: Fixed a vulnerability which made forceput operator in DefineResource to be still accessible which could allow access to file system outside of the constraints of -dSAFER (bsc#1129186). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1119=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ghostscript-9.26a-14.18.1 ghostscript-debuginfo-9.26a-14.18.1 ghostscript-debugsource-9.26a-14.18.1 ghostscript-devel-9.26a-14.18.1 ghostscript-mini-9.26a-14.18.1 ghostscript-mini-debuginfo-9.26a-14.18.1 ghostscript-mini-debugsource-9.26a-14.18.1 ghostscript-mini-devel-9.26a-14.18.1 ghostscript-x11-9.26a-14.18.1 ghostscript-x11-debuginfo-9.26a-14.18.1 References: https://www.suse.com/security/cve/CVE-2019-3838.html https://bugzilla.suse.com/1129186 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1110-1: moderate: Security update for lftp
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for lftp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1110-1 Rating: moderate References: #1103367 #1120946 Cross-References: CVE-2018-10916 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for lftp fixes the following issues: Security issue fixed: - CVE-2018-10916: Fixed an improper file name sanitization which could lead to loss of integrity of the local system (bsc#1103367). Other issue addressed: - The SSH login handling code detects password prompts more reliably (bsc#1120946). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1110=1 Package List: - openSUSE Leap 15.0 (x86_64): lftp-4.8.3-lp150.3.3.1 lftp-debuginfo-4.8.3-lp150.3.3.1 lftp-debugsource-4.8.3-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-10916.html https://bugzilla.suse.com/1103367 https://bugzilla.suse.com/1120946 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1117-1: moderate: Security update for unzip
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for unzip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1117-1 Rating: moderate References: #1110194 Cross-References: CVE-2018-18384 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for unzip fixes the following issues: - CVE-2018-18384: Fixed a buffer overflow when listing archives (bsc#1110194) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1117=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): unzip-6.00-lp150.8.3 unzip-debuginfo-6.00-lp150.8.3 unzip-debugsource-6.00-lp150.8.3 unzip-doc-6.00-lp150.8.3 - openSUSE Leap 15.0 (x86_64): unzip-rcc-6.00-lp150.8.3 unzip-rcc-debuginfo-6.00-lp150.8.3 unzip-rcc-debugsource-6.00-lp150.8.3 References: https://www.suse.com/security/cve/CVE-2018-18384.html https://bugzilla.suse.com/1110194 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1116-1: moderate: Security update for libqt5-qtsvg
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for libqt5-qtsvg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1116-1 Rating: moderate References: #1118599 Cross-References: CVE-2018-19869 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libqt5-qtsvg fixes the following issues: Security issues fixed: - CVE-2018-19869: Fixed Denial of Service when parsing malformed URL reference (bsc#1118599) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1116=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libQt5Svg5-5.9.4-lp150.2.3.2 libQt5Svg5-debuginfo-5.9.4-lp150.2.3.2 libqt5-qtsvg-debugsource-5.9.4-lp150.2.3.2 libqt5-qtsvg-devel-5.9.4-lp150.2.3.2 libqt5-qtsvg-examples-5.9.4-lp150.2.3.2 libqt5-qtsvg-examples-debuginfo-5.9.4-lp150.2.3.2 - openSUSE Leap 15.0 (x86_64): libQt5Svg5-32bit-5.9.4-lp150.2.3.2 libQt5Svg5-32bit-debuginfo-5.9.4-lp150.2.3.2 libqt5-qtsvg-devel-32bit-5.9.4-lp150.2.3.2 - openSUSE Leap 15.0 (noarch): libqt5-qtsvg-private-headers-devel-5.9.4-lp150.2.3.2 References: https://www.suse.com/security/cve/CVE-2018-19869.html https://bugzilla.suse.com/1118599 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0