May 2019 - openSUSE Security Announce - openSUSE Mailing Lists

[security-announce] openSUSE-SU-2019:1373-1: moderate: Security update for openssl
by opensuse-security＠opensuse.org 10 May '19

10 May '19

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1373-1 Rating: moderate References: #1131291 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for openssl fixes the following issues: - Reject invalid EC point coordinates (bsc#1131291) This helps openssl using services that do not do this verification on their own. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1373=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libopenssl-devel-1.0.2j-38.1 libopenssl1_0_0-1.0.2j-38.1 libopenssl1_0_0-debuginfo-1.0.2j-38.1 libopenssl1_0_0-hmac-1.0.2j-38.1 openssl-1.0.2j-38.1 openssl-cavs-1.0.2j-38.1 openssl-cavs-debuginfo-1.0.2j-38.1 openssl-debuginfo-1.0.2j-38.1 openssl-debugsource-1.0.2j-38.1 - openSUSE Leap 42.3 (noarch): openssl-doc-1.0.2j-38.1 - openSUSE Leap 42.3 (x86_64): libopenssl-devel-32bit-1.0.2j-38.1 libopenssl1_0_0-32bit-1.0.2j-38.1 libopenssl1_0_0-debuginfo-32bit-1.0.2j-38.1 libopenssl1_0_0-hmac-32bit-1.0.2j-38.1 References: https://bugzilla.suse.com/1131291 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1356-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 09 May '19

09 May '19

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1356-1 Rating: moderate References: #1131945 Cross-References: CVE-2019-10894 CVE-2019-10895 CVE-2019-10896 CVE-2019-10899 CVE-2019-10901 CVE-2019-10903 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for wireshark to version 2.4.14 fixes the following issues: Security issues fixed: - CVE-2019-10895: NetScaler file parser crash. - CVE-2019-10899: SRVLOC dissector crash. - CVE-2019-10894: GSS-API dissector crash. - CVE-2019-10896: DOF dissector crash. - CVE-2019-10901: LDSS dissector crash. - CVE-2019-10903: DCERPC SPOOLSS dissector crash. Non-security issue fixed: - Update to version 2.4.14 (bsc#1131945). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1356=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libwireshark9-2.4.14-lp150.2.26.3 libwireshark9-debuginfo-2.4.14-lp150.2.26.3 libwiretap7-2.4.14-lp150.2.26.3 libwiretap7-debuginfo-2.4.14-lp150.2.26.3 libwscodecs1-2.4.14-lp150.2.26.3 libwscodecs1-debuginfo-2.4.14-lp150.2.26.3 libwsutil8-2.4.14-lp150.2.26.3 libwsutil8-debuginfo-2.4.14-lp150.2.26.3 wireshark-2.4.14-lp150.2.26.3 wireshark-debuginfo-2.4.14-lp150.2.26.3 wireshark-debugsource-2.4.14-lp150.2.26.3 wireshark-devel-2.4.14-lp150.2.26.3 wireshark-ui-qt-2.4.14-lp150.2.26.3 wireshark-ui-qt-debuginfo-2.4.14-lp150.2.26.3 References: https://www.suse.com/security/cve/CVE-2019-10894.html https://www.suse.com/security/cve/CVE-2019-10895.html https://www.suse.com/security/cve/CVE-2019-10896.html https://www.suse.com/security/cve/CVE-2019-10899.html https://www.suse.com/security/cve/CVE-2019-10901.html https://www.suse.com/security/cve/CVE-2019-10903.html https://bugzilla.suse.com/1131945 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1355-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 09 May '19

09 May '19

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1355-1 Rating: moderate References: #1132053 #1132054 #1133202 #1133203 #1133498 #1133501 Cross-References: CVE-2019-11008 CVE-2019-11009 CVE-2019-11473 CVE-2019-11474 CVE-2019-11505 CVE-2019-11506 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: Security issues fixed: - CVE-2019-11506: Fixed a heap-based buffer overflow in the function WriteMATLABImage (boo#1133498). - CVE-2019-11505: Fixed a heap-based buffer overflow in the function WritePDBImage (boo#1133501). The following fixes where modified and refreshed: - CVE-2019-11008: Fixed a heap-based buffer overflow in the function WriteXWDImage (boo#1132054). - CVE-2019-11009: Fixed a heap-based buffer over-read in the function ReadXWDImage (boo#1132053). - CVE-2019-11473: Fixed an out-of-bounds read leading to a possible denial of service in coders/xwd.c (boo#1133203). - CVE-2019-11474: Fixed a floating-point exception leading to a possible denial of service in coders/xwd.c (boo#1133202). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1355=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-135.1 GraphicsMagick-debuginfo-1.3.25-135.1 GraphicsMagick-debugsource-1.3.25-135.1 GraphicsMagick-devel-1.3.25-135.1 libGraphicsMagick++-Q16-12-1.3.25-135.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-135.1 libGraphicsMagick++-devel-1.3.25-135.1 libGraphicsMagick-Q16-3-1.3.25-135.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-135.1 libGraphicsMagick3-config-1.3.25-135.1 libGraphicsMagickWand-Q16-2-1.3.25-135.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-135.1 perl-GraphicsMagick-1.3.25-135.1 perl-GraphicsMagick-debuginfo-1.3.25-135.1 References: https://www.suse.com/security/cve/CVE-2019-11008.html https://www.suse.com/security/cve/CVE-2019-11009.html https://www.suse.com/security/cve/CVE-2019-11473.html https://www.suse.com/security/cve/CVE-2019-11474.html https://www.suse.com/security/cve/CVE-2019-11505.html https://www.suse.com/security/cve/CVE-2019-11506.html https://bugzilla.suse.com/1132053 https://bugzilla.suse.com/1132054 https://bugzilla.suse.com/1133202 https://bugzilla.suse.com/1133203 https://bugzilla.suse.com/1133498 https://bugzilla.suse.com/1133501 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1354-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 09 May '19

09 May '19

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1354-1 Rating: moderate References: #1132053 #1132054 #1133202 #1133203 #1133498 #1133501 Cross-References: CVE-2019-11008 CVE-2019-11009 CVE-2019-11473 CVE-2019-11474 CVE-2019-11505 CVE-2019-11506 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: Security issues fixed: - CVE-2019-11506: Fixed a heap-based buffer overflow in the function WriteMATLABImage (boo#1133498). - CVE-2019-11505: Fixed a heap-based buffer overflow in the function WritePDBImage (boo#1133501). The following fixes where modified and refreshed: - CVE-2019-11008: Fixed a heap-based buffer overflow in the function WriteXWDImage (boo#1132054). - CVE-2019-11009: Fixed a heap-based buffer over-read in the function ReadXWDImage (boo#1132053). - CVE-2019-11473: Fixed an out-of-bounds read leading to a possible denial of service in coders/xwd.c (boo#1133203). - CVE-2019-11474: Fixed a floating-point exception leading to a possible denial of service in coders/xwd.c (boo#1133202). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1354=1 Package List: - openSUSE Leap 15.0 (x86_64): GraphicsMagick-1.3.29-lp150.3.28.1 GraphicsMagick-debuginfo-1.3.29-lp150.3.28.1 GraphicsMagick-debugsource-1.3.29-lp150.3.28.1 GraphicsMagick-devel-1.3.29-lp150.3.28.1 libGraphicsMagick++-Q16-12-1.3.29-lp150.3.28.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.29-lp150.3.28.1 libGraphicsMagick++-devel-1.3.29-lp150.3.28.1 libGraphicsMagick-Q16-3-1.3.29-lp150.3.28.1 libGraphicsMagick-Q16-3-debuginfo-1.3.29-lp150.3.28.1 libGraphicsMagick3-config-1.3.29-lp150.3.28.1 libGraphicsMagickWand-Q16-2-1.3.29-lp150.3.28.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.29-lp150.3.28.1 perl-GraphicsMagick-1.3.29-lp150.3.28.1 perl-GraphicsMagick-debuginfo-1.3.29-lp150.3.28.1 References: https://www.suse.com/security/cve/CVE-2019-11008.html https://www.suse.com/security/cve/CVE-2019-11009.html https://www.suse.com/security/cve/CVE-2019-11473.html https://www.suse.com/security/cve/CVE-2019-11474.html https://www.suse.com/security/cve/CVE-2019-11505.html https://www.suse.com/security/cve/CVE-2019-11506.html https://bugzilla.suse.com/1132053 https://bugzilla.suse.com/1132054 https://bugzilla.suse.com/1133202 https://bugzilla.suse.com/1133203 https://bugzilla.suse.com/1133498 https://bugzilla.suse.com/1133501 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1352-1: moderate: Security update for ovmf
by opensuse-security＠opensuse.org 08 May '19

08 May '19

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1352-1 Rating: moderate References: #1131361 Cross-References: CVE-2019-0161 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ovmf fixes the following issues: Security issue fixed: - CVE-2019-0161: Fixed a stack overflow in UsbBusDxe and UsbBusPei, which could potentially be triggered by a local unauthenticated user (bsc#1131361). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1352=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ovmf-2017+git1510945757.b2662641d5-lp150.4.19.1 ovmf-tools-2017+git1510945757.b2662641d5-lp150.4.19.1 - openSUSE Leap 15.0 (noarch): qemu-ovmf-ia32-2017+git1510945757.b2662641d5-lp150.4.19.1 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-lp150.4.19.1 - openSUSE Leap 15.0 (x86_64): qemu-ovmf-x86_64-debug-2017+git1510945757.b2662641d5-lp150.4.19.1 References: https://www.suse.com/security/cve/CVE-2019-0161.html https://bugzilla.suse.com/1131361 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1351-1: important: Security update for hostinfo, supportutils
by opensuse-security＠opensuse.org 08 May '19

08 May '19

openSUSE Security Update: Security update for hostinfo, supportutils ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1351-1 Rating: important References: #1054979 #1099498 #1115245 #1117751 #1117776 #1118460 #1118462 #1118463 #1125623 #1125666 Cross-References: CVE-2018-19636 CVE-2018-19637 CVE-2018-19638 CVE-2018-19639 CVE-2018-19640 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has 5 fixes is now available. Description: This update for hostinfo, supportutils fixes the following issues: Security issues fixed for supportutils: - CVE-2018-19640: Fixed an issue where users could kill arbitrary processes (bsc#1118463). - CVE-2018-19638: Fixed an issue where users could overwrite arbitrary log files (bsc#1118460). - CVE-2018-19639: Fixed a code execution if run with -v (bsc#1118462). - CVE-2018-19637: Fixed an issue where static temporary filename could allow overwriting of files (bsc#1117776). - CVE-2018-19636: Fixed a local root exploit via inclusion of attacker controlled shell script (bsc#1117751). Other issues fixed for supportutils: - Fixed invalid exit code commands (bsc#1125666) - SUSE separation in supportconfig (bsc#1125623) - Clarified supportconfig(8) -x option (bsc#1115245) - supportconfig: 3.0.127 - btrfs filesystem usage - List products.d - Dump lsof errors - Added ha commands for corosync - Dumped find errors in ib_info Issues fixed in hostinfo: - Removed extra kernel install dates (bsc#1099498) - Resolved network bond issue (bsc#1054979) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1351=1 Package List: - openSUSE Leap 42.3 (noarch): hostinfo-1.0.1-21.3.1 References: https://www.suse.com/security/cve/CVE-2018-19636.html https://www.suse.com/security/cve/CVE-2018-19637.html https://www.suse.com/security/cve/CVE-2018-19638.html https://www.suse.com/security/cve/CVE-2018-19639.html https://www.suse.com/security/cve/CVE-2018-19640.html https://bugzilla.suse.com/1054979 https://bugzilla.suse.com/1099498 https://bugzilla.suse.com/1115245 https://bugzilla.suse.com/1117751 https://bugzilla.suse.com/1117776 https://bugzilla.suse.com/1118460 https://bugzilla.suse.com/1118462 https://bugzilla.suse.com/1118463 https://bugzilla.suse.com/1125623 https://bugzilla.suse.com/1125666 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1353-1: important: Security update for gnutls
by opensuse-security＠opensuse.org 08 May '19

08 May '19

openSUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1353-1 Rating: important References: #1118087 #1130681 #1130682 Cross-References: CVE-2018-16868 CVE-2019-3829 CVE-2019-3836 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for gnutls fixes to version 3.6.7 the following issues: Security issued fixed: - CVE-2019-3836: Fixed an invalid pointer access via malformed TLS1.3 async messages (bsc#1130682). - CVE-2019-3829: Fixed a double free vulnerability in the certificate verification API (bsc#1130681). - CVE-2018-16868: Fixed Bleichenbacher-like side channel leakage in PKCS#1 v1.5 verification and padding oracle verification (bsc#1118087) Non-security issue fixed: - Update gnutls to support TLS 1.3 (fate#327114) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1353=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): gnutls-3.6.7-lp150.9.1 gnutls-debuginfo-3.6.7-lp150.9.1 gnutls-debugsource-3.6.7-lp150.9.1 gnutls-guile-3.6.7-lp150.9.1 gnutls-guile-debuginfo-3.6.7-lp150.9.1 libgnutls-dane-devel-3.6.7-lp150.9.1 libgnutls-dane0-3.6.7-lp150.9.1 libgnutls-dane0-debuginfo-3.6.7-lp150.9.1 libgnutls-devel-3.6.7-lp150.9.1 libgnutls30-3.6.7-lp150.9.1 libgnutls30-debuginfo-3.6.7-lp150.9.1 libgnutlsxx-devel-3.6.7-lp150.9.1 libgnutlsxx28-3.6.7-lp150.9.1 libgnutlsxx28-debuginfo-3.6.7-lp150.9.1 - openSUSE Leap 15.0 (x86_64): libgnutls-devel-32bit-3.6.7-lp150.9.1 libgnutls30-32bit-3.6.7-lp150.9.1 libgnutls30-32bit-debuginfo-3.6.7-lp150.9.1 References: https://www.suse.com/security/cve/CVE-2018-16868.html https://www.suse.com/security/cve/CVE-2019-3829.html https://www.suse.com/security/cve/CVE-2019-3836.html https://bugzilla.suse.com/1118087 https://bugzilla.suse.com/1130681 https://bugzilla.suse.com/1130682 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1341-1: Security update for yubico-piv-tool
by opensuse-security＠opensuse.org 08 May '19

08 May '19

openSUSE Security Update: Security update for yubico-piv-tool ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1341-1 Rating: low References: #1104809 #1104811 Cross-References: CVE-2018-14779 CVE-2018-14780 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for yubico-piv-tool fixes the following issues: Security issues fixed: - Fixed an buffer overflow and an out of bounds memory read in ykpiv_transfer_data(), which could be triggered by a malicious token. (CVE-2018-14779, bsc#1104809, YSA-2018-03) - Fixed an buffer overflow and an out of bounds memory read in _ykpiv_fetch_object(), which could be triggered by a malicious token. (CVE-2018-14780, bsc#1104811, YSA-2018-03) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1341=1 Package List: - openSUSE Leap 15.0 (x86_64): libykcs11-1-1.5.0-lp150.2.3.1 libykcs11-1-debuginfo-1.5.0-lp150.2.3.1 libykcs11-devel-1.5.0-lp150.2.3.1 libykpiv-devel-1.5.0-lp150.2.3.1 libykpiv1-1.5.0-lp150.2.3.1 libykpiv1-debuginfo-1.5.0-lp150.2.3.1 yubico-piv-tool-1.5.0-lp150.2.3.1 yubico-piv-tool-debuginfo-1.5.0-lp150.2.3.1 yubico-piv-tool-debugsource-1.5.0-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-14779.html https://www.suse.com/security/cve/CVE-2018-14780.html https://bugzilla.suse.com/1104809 https://bugzilla.suse.com/1104811 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1343-1: moderate: Security update for libjpeg-turbo
by opensuse-security＠opensuse.org 08 May '19

08 May '19

openSUSE Security Update: Security update for libjpeg-turbo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1343-1 Rating: moderate References: #1096209 #1098155 #1128712 Cross-References: CVE-2018-1152 CVE-2018-11813 CVE-2018-14498 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libjpeg-turbo fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-14498: Fixed a heap-based buffer over read in get_8bit_row function which could allow to an attacker to cause denial of service (bsc#1128712). - CVE-2018-11813: Fixed the end-of-file mishandling in read_pixel in rdtarga.c, which allowed remote attackers to cause a denial-of-service via crafted JPG files due to a large loop (bsc#1096209) - CVE-2018-1152: Fixed a denial of service in start_input_bmp() rdbmp.c caused by a divide by zero when processing a crafted BMP image (bsc#1098155) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1343=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libjpeg-turbo-1.5.3-45.1 libjpeg-turbo-debuginfo-1.5.3-45.1 libjpeg-turbo-debugsource-1.5.3-45.1 libjpeg62-62.2.0-45.1 libjpeg62-debuginfo-62.2.0-45.1 libjpeg62-devel-62.2.0-45.1 libjpeg62-turbo-1.5.3-45.1 libjpeg62-turbo-debugsource-1.5.3-45.1 libjpeg8-8.1.2-45.1 libjpeg8-debuginfo-8.1.2-45.1 libjpeg8-devel-8.1.2-45.1 libturbojpeg0-8.1.2-45.1 libturbojpeg0-debuginfo-8.1.2-45.1 - openSUSE Leap 42.3 (x86_64): libjpeg62-32bit-62.2.0-45.1 libjpeg62-debuginfo-32bit-62.2.0-45.1 libjpeg62-devel-32bit-62.2.0-45.1 libjpeg8-32bit-8.1.2-45.1 libjpeg8-debuginfo-32bit-8.1.2-45.1 libjpeg8-devel-32bit-8.1.2-45.1 libturbojpeg0-32bit-8.1.2-45.1 libturbojpeg0-debuginfo-32bit-8.1.2-45.1 References: https://www.suse.com/security/cve/CVE-2018-1152.html https://www.suse.com/security/cve/CVE-2018-11813.html https://www.suse.com/security/cve/CVE-2018-14498.html https://bugzilla.suse.com/1096209 https://bugzilla.suse.com/1098155 https://bugzilla.suse.com/1128712 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1346-1: important: Security update for freeradius-server
by opensuse-security＠opensuse.org 08 May '19

08 May '19

openSUSE Security Update: Security update for freeradius-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1346-1 Rating: important References: #1132549 #1132664 Cross-References: CVE-2019-11234 CVE-2019-11235 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for freeradius-server fixes the following issues: Security issues fixed: - CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points (bsc#1132549). - CVE-2019-11234: Fixed an authentication bypass caused by reflecting privous values back to the server (bsc#1132664). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1346=1 Package List: - openSUSE Leap 15.0 (x86_64): freeradius-server-3.0.16-lp150.2.3.1 freeradius-server-debuginfo-3.0.16-lp150.2.3.1 freeradius-server-debugsource-3.0.16-lp150.2.3.1 freeradius-server-devel-3.0.16-lp150.2.3.1 freeradius-server-doc-3.0.16-lp150.2.3.1 freeradius-server-krb5-3.0.16-lp150.2.3.1 freeradius-server-krb5-debuginfo-3.0.16-lp150.2.3.1 freeradius-server-ldap-3.0.16-lp150.2.3.1 freeradius-server-ldap-debuginfo-3.0.16-lp150.2.3.1 freeradius-server-libs-3.0.16-lp150.2.3.1 freeradius-server-libs-debuginfo-3.0.16-lp150.2.3.1 freeradius-server-mysql-3.0.16-lp150.2.3.1 freeradius-server-mysql-debuginfo-3.0.16-lp150.2.3.1 freeradius-server-perl-3.0.16-lp150.2.3.1 freeradius-server-perl-debuginfo-3.0.16-lp150.2.3.1 freeradius-server-postgresql-3.0.16-lp150.2.3.1 freeradius-server-postgresql-debuginfo-3.0.16-lp150.2.3.1 freeradius-server-python-3.0.16-lp150.2.3.1 freeradius-server-python-debuginfo-3.0.16-lp150.2.3.1 freeradius-server-sqlite-3.0.16-lp150.2.3.1 freeradius-server-sqlite-debuginfo-3.0.16-lp150.2.3.1 freeradius-server-utils-3.0.16-lp150.2.3.1 freeradius-server-utils-debuginfo-3.0.16-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-11234.html https://www.suse.com/security/cve/CVE-2019-11235.html https://bugzilla.suse.com/1132549 https://bugzilla.suse.com/1132664 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0