April 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:1147-1: moderate: Security update for openssl-1_1
by opensuse-security＠opensuse.org 04 Apr '19

04 Apr '19

openSUSE Security Update: Security update for openssl-1_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1147-1 Rating: moderate References: #1116833 #1125494 #1128189 Cross-References: CVE-2019-1543 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for openssl-1_1 (OpenSSL Security Advisory [6 March 2019]) fixes the following issues: Security issue fixed: - CVE-2019-1543: Fixed an implementation error in ChaCha20-Poly1305 where it was allowed to set IV with more than 12 bytes (bsc#1128189). Other issues addressed: - Fixed a segfault in openssl speed when an unknown algorithm is passed (bsc#1125494). - Correctly skipped binary curves in openssl speed to avoid spitting errors (bsc#1116833). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1147=1 Package List: - openSUSE Leap 15.0 (noarch): openssl-1_1-doc-1.1.0i-lp150.3.22.3 - openSUSE Leap 15.0 (x86_64): libopenssl-1_1-devel-1.1.0i-lp150.3.22.3 libopenssl1_1-1.1.0i-lp150.3.22.3 libopenssl1_1-debuginfo-1.1.0i-lp150.3.22.3 libopenssl1_1-hmac-1.1.0i-lp150.3.22.3 openssl-1_1-1.1.0i-lp150.3.22.3 openssl-1_1-debuginfo-1.1.0i-lp150.3.22.3 openssl-1_1-debugsource-1.1.0i-lp150.3.22.3 References: https://www.suse.com/security/cve/CVE-2019-1543.html https://bugzilla.suse.com/1116833 https://bugzilla.suse.com/1125494 https://bugzilla.suse.com/1128189 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1152-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 04 Apr '19

04 Apr '19

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1152-1 Rating: important References: #1129821 #1130262 Cross-References: CVE-2019-9810 CVE-2019-9813 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: Security issues fixed: - update to Mozilla Thunderbird 60.6.1 (bsc#1130262): - CVE-2019-9813: Fixed Ionmonkey type confusion with __proto__ mutations - CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1152=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaThunderbird-60.6.1-89.1 MozillaThunderbird-buildsymbols-60.6.1-89.1 MozillaThunderbird-debuginfo-60.6.1-89.1 MozillaThunderbird-debugsource-60.6.1-89.1 MozillaThunderbird-translations-common-60.6.1-89.1 MozillaThunderbird-translations-other-60.6.1-89.1 References: https://www.suse.com/security/cve/CVE-2019-9810.html https://www.suse.com/security/cve/CVE-2019-9813.html https://bugzilla.suse.com/1129821 https://bugzilla.suse.com/1130262 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1148-1: moderate: Security update for gd
by opensuse-security＠opensuse.org 04 Apr '19

04 Apr '19

openSUSE Security Update: Security update for gd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1148-1 Rating: moderate References: #1123361 #1123522 Cross-References: CVE-2019-6977 CVE-2019-6978 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for gd fixes the following issues: Security issues fixed: - CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function (bsc#1123361). - CVE-2019-6978: Fixed a double free in the gdImage*Ptr() functions (bsc#1123522). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1148=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): gd-2.2.5-lp150.8.1 gd-debuginfo-2.2.5-lp150.8.1 gd-debugsource-2.2.5-lp150.8.1 gd-devel-2.2.5-lp150.8.1 libgd3-2.2.5-lp150.8.1 libgd3-debuginfo-2.2.5-lp150.8.1 - openSUSE Leap 15.0 (x86_64): libgd3-32bit-2.2.5-lp150.8.1 libgd3-32bit-debuginfo-2.2.5-lp150.8.1 References: https://www.suse.com/security/cve/CVE-2019-6977.html https://www.suse.com/security/cve/CVE-2019-6978.html https://bugzilla.suse.com/1123361 https://bugzilla.suse.com/1123522 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1128-1: important: Security update for pdns
by opensuse-security＠opensuse.org 03 Apr '19

03 Apr '19

openSUSE Security Update: Security update for pdns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1128-1 Rating: important References: #1129734 Cross-References: CVE-2019-3871 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pdns fixes the following issue: Security issue fixed: - CVE-2019-3871: Fixed an insufficient validation in the HTTP remote backend which could allow a remote user to cause the HTTP backend to connect to an attacker-specified host instead of the configured one (bsc#1129734). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1128=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1128=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1128=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1128=1 Package List: - openSUSE Leap 42.3 (x86_64): pdns-4.0.3-18.1 pdns-backend-geoip-4.0.3-18.1 pdns-backend-geoip-debuginfo-4.0.3-18.1 pdns-backend-godbc-4.0.3-18.1 pdns-backend-godbc-debuginfo-4.0.3-18.1 pdns-backend-ldap-4.0.3-18.1 pdns-backend-ldap-debuginfo-4.0.3-18.1 pdns-backend-lua-4.0.3-18.1 pdns-backend-lua-debuginfo-4.0.3-18.1 pdns-backend-mydns-4.0.3-18.1 pdns-backend-mydns-debuginfo-4.0.3-18.1 pdns-backend-mysql-4.0.3-18.1 pdns-backend-mysql-debuginfo-4.0.3-18.1 pdns-backend-postgresql-4.0.3-18.1 pdns-backend-postgresql-debuginfo-4.0.3-18.1 pdns-backend-remote-4.0.3-18.1 pdns-backend-remote-debuginfo-4.0.3-18.1 pdns-backend-sqlite3-4.0.3-18.1 pdns-backend-sqlite3-debuginfo-4.0.3-18.1 pdns-debuginfo-4.0.3-18.1 pdns-debugsource-4.0.3-18.1 - openSUSE Leap 15.0 (x86_64): pdns-4.1.2-lp150.3.10.1 pdns-backend-geoip-4.1.2-lp150.3.10.1 pdns-backend-geoip-debuginfo-4.1.2-lp150.3.10.1 pdns-backend-godbc-4.1.2-lp150.3.10.1 pdns-backend-godbc-debuginfo-4.1.2-lp150.3.10.1 pdns-backend-ldap-4.1.2-lp150.3.10.1 pdns-backend-ldap-debuginfo-4.1.2-lp150.3.10.1 pdns-backend-lua-4.1.2-lp150.3.10.1 pdns-backend-lua-debuginfo-4.1.2-lp150.3.10.1 pdns-backend-mydns-4.1.2-lp150.3.10.1 pdns-backend-mydns-debuginfo-4.1.2-lp150.3.10.1 pdns-backend-mysql-4.1.2-lp150.3.10.1 pdns-backend-mysql-debuginfo-4.1.2-lp150.3.10.1 pdns-backend-postgresql-4.1.2-lp150.3.10.1 pdns-backend-postgresql-debuginfo-4.1.2-lp150.3.10.1 pdns-backend-remote-4.1.2-lp150.3.10.1 pdns-backend-remote-debuginfo-4.1.2-lp150.3.10.1 pdns-backend-sqlite3-4.1.2-lp150.3.10.1 pdns-backend-sqlite3-debuginfo-4.1.2-lp150.3.10.1 pdns-debuginfo-4.1.2-lp150.3.10.1 pdns-debugsource-4.1.2-lp150.3.10.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): pdns-4.1.2-bp150.2.6.1 pdns-backend-geoip-4.1.2-bp150.2.6.1 pdns-backend-godbc-4.1.2-bp150.2.6.1 pdns-backend-ldap-4.1.2-bp150.2.6.1 pdns-backend-lua-4.1.2-bp150.2.6.1 pdns-backend-mydns-4.1.2-bp150.2.6.1 pdns-backend-mysql-4.1.2-bp150.2.6.1 pdns-backend-postgresql-4.1.2-bp150.2.6.1 pdns-backend-remote-4.1.2-bp150.2.6.1 pdns-backend-sqlite3-4.1.2-bp150.2.6.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): pdns-4.1.7-17.1 pdns-backend-godbc-4.1.7-17.1 pdns-backend-ldap-4.1.7-17.1 pdns-backend-lua-4.1.7-17.1 pdns-backend-mydns-4.1.7-17.1 pdns-backend-mysql-4.1.7-17.1 pdns-backend-postgresql-4.1.7-17.1 pdns-backend-remote-4.1.7-17.1 pdns-backend-sqlite3-4.1.7-17.1 References: https://www.suse.com/security/cve/CVE-2019-3871.html https://bugzilla.suse.com/1129734 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1126-1: critical: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 03 Apr '19

03 Apr '19

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1126-1 Rating: critical References: #1129821 #1130262 Cross-References: CVE-2018-18506 CVE-2019-5785 CVE-2019-9788 CVE-2019-9790 CVE-2019-9791 CVE-2019-9792 CVE-2019-9793 CVE-2019-9794 CVE-2019-9795 CVE-2019-9796 CVE-2019-9801 CVE-2019-9810 CVE-2019-9813 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: Security issues fixed: - Update to MozillaThunderbird 60.6.1 (bsc#1130262): - CVE-2019-9813: Fixed Ionmonkey type confusion with __proto__ mutations - CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information - Update to MozillaThunderbird 60.6 (bsc#1129821): - CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file - CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content - CVE-2019-9788: Fixed multiple memory safety bugs - CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements - CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement with IonMonkey - CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script - CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled - CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution - CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler - CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-11/ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1126=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-60.6.1-82.1 MozillaThunderbird-buildsymbols-60.6.1-82.1 MozillaThunderbird-translations-common-60.6.1-82.1 MozillaThunderbird-translations-other-60.6.1-82.1 References: https://www.suse.com/security/cve/CVE-2018-18506.html https://www.suse.com/security/cve/CVE-2019-5785.html https://www.suse.com/security/cve/CVE-2019-9788.html https://www.suse.com/security/cve/CVE-2019-9790.html https://www.suse.com/security/cve/CVE-2019-9791.html https://www.suse.com/security/cve/CVE-2019-9792.html https://www.suse.com/security/cve/CVE-2019-9793.html https://www.suse.com/security/cve/CVE-2019-9794.html https://www.suse.com/security/cve/CVE-2019-9795.html https://www.suse.com/security/cve/CVE-2019-9796.html https://www.suse.com/security/cve/CVE-2019-9801.html https://www.suse.com/security/cve/CVE-2019-9810.html https://www.suse.com/security/cve/CVE-2019-9813.html https://bugzilla.suse.com/1129821 https://bugzilla.suse.com/1130262 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1128-1: important: Security update for pdns
by opensuse-security＠opensuse.org 03 Apr '19

03 Apr '19

openSUSE Security Update: Security update for pdns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1128-1 Rating: important References: #1129734 Cross-References: CVE-2019-3871 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pdns fixes the following issue: Security issue fixed: - CVE-2019-3871: Fixed an insufficient validation in the HTTP remote backend which could allow a remote user to cause the HTTP backend to connect to an attacker-specified host instead of the configured one (bsc#1129734). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1128=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1128=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1128=1 Package List: - openSUSE Leap 42.3 (x86_64): pdns-4.0.3-18.1 pdns-backend-geoip-4.0.3-18.1 pdns-backend-geoip-debuginfo-4.0.3-18.1 pdns-backend-godbc-4.0.3-18.1 pdns-backend-godbc-debuginfo-4.0.3-18.1 pdns-backend-ldap-4.0.3-18.1 pdns-backend-ldap-debuginfo-4.0.3-18.1 pdns-backend-lua-4.0.3-18.1 pdns-backend-lua-debuginfo-4.0.3-18.1 pdns-backend-mydns-4.0.3-18.1 pdns-backend-mydns-debuginfo-4.0.3-18.1 pdns-backend-mysql-4.0.3-18.1 pdns-backend-mysql-debuginfo-4.0.3-18.1 pdns-backend-postgresql-4.0.3-18.1 pdns-backend-postgresql-debuginfo-4.0.3-18.1 pdns-backend-remote-4.0.3-18.1 pdns-backend-remote-debuginfo-4.0.3-18.1 pdns-backend-sqlite3-4.0.3-18.1 pdns-backend-sqlite3-debuginfo-4.0.3-18.1 pdns-debuginfo-4.0.3-18.1 pdns-debugsource-4.0.3-18.1 - openSUSE Leap 15.0 (x86_64): pdns-4.1.2-lp150.3.10.1 pdns-backend-geoip-4.1.2-lp150.3.10.1 pdns-backend-geoip-debuginfo-4.1.2-lp150.3.10.1 pdns-backend-godbc-4.1.2-lp150.3.10.1 pdns-backend-godbc-debuginfo-4.1.2-lp150.3.10.1 pdns-backend-ldap-4.1.2-lp150.3.10.1 pdns-backend-ldap-debuginfo-4.1.2-lp150.3.10.1 pdns-backend-lua-4.1.2-lp150.3.10.1 pdns-backend-lua-debuginfo-4.1.2-lp150.3.10.1 pdns-backend-mydns-4.1.2-lp150.3.10.1 pdns-backend-mydns-debuginfo-4.1.2-lp150.3.10.1 pdns-backend-mysql-4.1.2-lp150.3.10.1 pdns-backend-mysql-debuginfo-4.1.2-lp150.3.10.1 pdns-backend-postgresql-4.1.2-lp150.3.10.1 pdns-backend-postgresql-debuginfo-4.1.2-lp150.3.10.1 pdns-backend-remote-4.1.2-lp150.3.10.1 pdns-backend-remote-debuginfo-4.1.2-lp150.3.10.1 pdns-backend-sqlite3-4.1.2-lp150.3.10.1 pdns-backend-sqlite3-debuginfo-4.1.2-lp150.3.10.1 pdns-debuginfo-4.1.2-lp150.3.10.1 pdns-debugsource-4.1.2-lp150.3.10.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): pdns-4.1.2-bp150.2.6.1 pdns-backend-geoip-4.1.2-bp150.2.6.1 pdns-backend-godbc-4.1.2-bp150.2.6.1 pdns-backend-ldap-4.1.2-bp150.2.6.1 pdns-backend-lua-4.1.2-bp150.2.6.1 pdns-backend-mydns-4.1.2-bp150.2.6.1 pdns-backend-mysql-4.1.2-bp150.2.6.1 pdns-backend-postgresql-4.1.2-bp150.2.6.1 pdns-backend-remote-4.1.2-bp150.2.6.1 pdns-backend-sqlite3-4.1.2-bp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-3871.html https://bugzilla.suse.com/1129734 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1125-1: moderate: Security update for ansible
by opensuse-security＠opensuse.org 03 Apr '19

03 Apr '19

openSUSE Security Update: Security update for ansible ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1125-1 Rating: moderate References: #1099808 #1102126 #1109957 #1112959 #1116587 #1118896 #1126503 Cross-References: CVE-2018-10875 CVE-2018-16837 CVE-2018-16859 CVE-2018-16876 CVE-2019-3828 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has two fixes is now available. Description: This update for ansible to version 2.7.8 fixes the following issues: Security issues fixed: - CVE-2018-16837: Fixed an information leak in user module (bsc#1112959). - CVE-2018-16859: Fixed an issue which clould allow logging of password in plaintext in Windows powerShell (bsc#1116587). - CVE-2019-3828: Fixed a path traversal vulnerability in fetch module (bsc#1126503). - CVE-2018-10875: Fixed a potential code execution in ansible.cfg (bsc#1099808). - CVE-2018-16876: Fixed an issue which could allow information disclosure in vvv+ mode with no_log on (bsc#1118896). Other issues addressed: - prepare update to 2.7.8 for multiple releases (boo#1102126, boo#1109957) Release notes: https://github.com/ansible/ansible/blob/stable-2.7/changelogs/CHANGELOG-v2. 7.rst#id1 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1125=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): ansible-2.7.8-9.1 References: https://www.suse.com/security/cve/CVE-2018-10875.html https://www.suse.com/security/cve/CVE-2018-16837.html https://www.suse.com/security/cve/CVE-2018-16859.html https://www.suse.com/security/cve/CVE-2018-16876.html https://www.suse.com/security/cve/CVE-2019-3828.html https://bugzilla.suse.com/1099808 https://bugzilla.suse.com/1102126 https://bugzilla.suse.com/1109957 https://bugzilla.suse.com/1112959 https://bugzilla.suse.com/1116587 https://bugzilla.suse.com/1118896 https://bugzilla.suse.com/1126503 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1123-1: moderate: Security update for putty
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for putty ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1123-1 Rating: moderate References: #1129633 Cross-References: CVE-2019-9894 CVE-2019-9895 CVE-2019-9896 CVE-2019-9897 CVE-2019-9898 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for putty fixes the following issues: Update to new upstream release 0.71 [boo#1129633] * CVE-2019-9894: Fixed a remotely triggerable memory overwrite in RSA key exchange, which can occur before host key verification potential recycling of random numbers used in cryptography. * CVE-2019-9895: Fixed a remotely triggerable buffer overflow in any kind of server-to-client forwarding. * CVE-2019-9897: Fixed multiple denial-of-service attacks that can be triggered by writing to the terminal. * CVE-2019-9898: Fixed potential recycling of random numbers used in cryptography * CVE-2019-9896 (Windows only): Fixed hijacking by a malicious help file in the same directory as the executable * Major rewrite of the crypto code to remove cache and timing side channels. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1123=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): putty-0.71-bp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-9894.html https://www.suse.com/security/cve/CVE-2019-9895.html https://www.suse.com/security/cve/CVE-2019-9896.html https://www.suse.com/security/cve/CVE-2019-9897.html https://www.suse.com/security/cve/CVE-2019-9898.html https://bugzilla.suse.com/1129633 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1105-1: moderate: Security update for openssl-1_0_0
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for openssl-1_0_0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1105-1 Rating: moderate References: #1117951 #1127080 Cross-References: CVE-2019-1559 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for openssl-1_0_0 fixes the following issues: Security issues fixed: - The 9 Lives of Bleichenbacher's CAT: Cache Attacks on TLS Implementations (bsc#1117951) - CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding Oracle which under certain circumstances a TLS server can be forced to respond differently to a client and lead to the decryption of the data (bsc#1127080). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1105=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libopenssl-1_0_0-devel-1.0.2p-lp150.2.13.1 libopenssl1_0_0-1.0.2p-lp150.2.13.1 libopenssl1_0_0-debuginfo-1.0.2p-lp150.2.13.1 libopenssl1_0_0-hmac-1.0.2p-lp150.2.13.1 openssl-1_0_0-1.0.2p-lp150.2.13.1 openssl-1_0_0-cavs-1.0.2p-lp150.2.13.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-lp150.2.13.1 openssl-1_0_0-debuginfo-1.0.2p-lp150.2.13.1 openssl-1_0_0-debugsource-1.0.2p-lp150.2.13.1 - openSUSE Leap 15.0 (noarch): openssl-1_0_0-doc-1.0.2p-lp150.2.13.1 - openSUSE Leap 15.0 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-lp150.2.13.1 libopenssl1_0_0-32bit-1.0.2p-lp150.2.13.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-lp150.2.13.1 libopenssl1_0_0-hmac-32bit-1.0.2p-lp150.2.13.1 References: https://www.suse.com/security/cve/CVE-2019-1559.html https://bugzilla.suse.com/1117951 https://bugzilla.suse.com/1127080 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1121-1: important: Security update for ghostscript
by opensuse-security＠opensuse.org 02 Apr '19

02 Apr '19

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1121-1 Rating: important References: #1129186 Cross-References: CVE-2019-3838 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ghostscript fixes the following issue: Security issue fixed: - CVE-2019-3838: Fixed a vulnerability which made forceput operator in DefineResource to be still accessible which could allow access to file system outside of the constraints of -dSAFER (bsc#1129186). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1121=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ghostscript-9.26a-lp150.2.17.2 ghostscript-debuginfo-9.26a-lp150.2.17.2 ghostscript-debugsource-9.26a-lp150.2.17.2 ghostscript-devel-9.26a-lp150.2.17.2 ghostscript-mini-9.26a-lp150.2.17.2 ghostscript-mini-debuginfo-9.26a-lp150.2.17.2 ghostscript-mini-debugsource-9.26a-lp150.2.17.2 ghostscript-mini-devel-9.26a-lp150.2.17.2 ghostscript-x11-9.26a-lp150.2.17.2 ghostscript-x11-debuginfo-9.26a-lp150.2.17.2 References: https://www.suse.com/security/cve/CVE-2019-3838.html https://bugzilla.suse.com/1129186 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0