May 2019 - openSUSE Security Announce - openSUSE Mailing Lists

[security-announce] openSUSE-SU-2019:1456-1: important: Security update for chromium
by opensuse-security＠opensuse.org 27 May '19

27 May '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1456-1 Rating: important References: #1134218 Cross-References: CVE-2019-5824 CVE-2019-5827 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to 74.0.3729.157: - Various security fixes from internal audits, fuzzing and other initiatives Includes security fixes from 74.0.3729.131 (boo#1134218): - CVE-2019-5827: Out-of-bounds access in SQLite - CVE-2019-5824: Parameter passing error in media player Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1456=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1456=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1456=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-74.0.3729.157-211.1 chromedriver-debuginfo-74.0.3729.157-211.1 chromium-74.0.3729.157-211.1 chromium-debuginfo-74.0.3729.157-211.1 chromium-debugsource-74.0.3729.157-211.1 - openSUSE Leap 15.1 (x86_64): chromedriver-74.0.3729.157-lp151.2.3.1 chromedriver-debuginfo-74.0.3729.157-lp151.2.3.1 chromium-74.0.3729.157-lp151.2.3.1 chromium-debuginfo-74.0.3729.157-lp151.2.3.1 chromium-debugsource-74.0.3729.157-lp151.2.3.1 - openSUSE Leap 15.0 (x86_64): chromedriver-74.0.3729.157-lp150.212.1 chromedriver-debuginfo-74.0.3729.157-lp150.212.1 chromium-74.0.3729.157-lp150.212.1 chromium-debuginfo-74.0.3729.157-lp150.212.1 chromium-debugsource-74.0.3729.157-lp150.212.1 References: https://www.suse.com/security/cve/CVE-2019-5824.html https://www.suse.com/security/cve/CVE-2019-5827.html https://bugzilla.suse.com/1134218 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1450-1: important: Security update for systemd
by opensuse-security＠opensuse.org 27 May '19

27 May '19

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1450-1 Rating: important References: #1080919 #1121563 #1125352 #1126056 #1127557 #1128657 #1130230 #1132348 #1132400 #1132721 #955942 Cross-References: CVE-2018-6954 CVE-2019-3842 CVE-2019-6454 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has 8 fixes is now available. Description: This update for systemd fixes the following issues: Security issues fixed: - CVE-2018-6954: Fixed a vulnerability in the symlink handling of systemd-tmpfiles which allowed a local user to obtain ownership of arbitrary files (bsc#1080919). - CVE-2019-3842: Fixed a vulnerability in pam_systemd which allowed a local user to escalate privileges (bsc#1132348). - CVE-2019-6454: Fixed a denial of service caused by long dbus messages (bsc#1125352). Non-security issues fixed: - systemd-coredump: generate a stack trace of all core dumps (jsc#SLE-5933) - udevd: notify when max number value of children is reached only once per batch of events (bsc#1132400) - sd-bus: bump message queue size again (bsc#1132721) - core: only watch processes when it's really necessary (bsc#955942 bsc#1128657) - rules: load drivers only on "add" events (bsc#1126056) - sysctl: Don't pass null directive argument to '%s' (bsc#1121563) - Do not automatically online memory on s390x (bsc#1127557) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1450=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libsystemd0-228-71.1 libsystemd0-debuginfo-228-71.1 libsystemd0-mini-228-71.1 libsystemd0-mini-debuginfo-228-71.1 libudev-devel-228-71.1 libudev-mini-devel-228-71.1 libudev-mini1-228-71.1 libudev-mini1-debuginfo-228-71.1 libudev1-228-71.1 libudev1-debuginfo-228-71.1 nss-myhostname-228-71.1 nss-myhostname-debuginfo-228-71.1 nss-mymachines-228-71.1 nss-mymachines-debuginfo-228-71.1 systemd-228-71.1 systemd-debuginfo-228-71.1 systemd-debugsource-228-71.1 systemd-devel-228-71.1 systemd-logger-228-71.1 systemd-mini-228-71.1 systemd-mini-debuginfo-228-71.1 systemd-mini-debugsource-228-71.1 systemd-mini-devel-228-71.1 systemd-mini-sysvinit-228-71.1 systemd-sysvinit-228-71.1 udev-228-71.1 udev-debuginfo-228-71.1 udev-mini-228-71.1 udev-mini-debuginfo-228-71.1 - openSUSE Leap 42.3 (noarch): systemd-bash-completion-228-71.1 systemd-mini-bash-completion-228-71.1 - openSUSE Leap 42.3 (x86_64): libsystemd0-32bit-228-71.1 libsystemd0-debuginfo-32bit-228-71.1 libudev1-32bit-228-71.1 libudev1-debuginfo-32bit-228-71.1 nss-myhostname-32bit-228-71.1 nss-myhostname-debuginfo-32bit-228-71.1 systemd-32bit-228-71.1 systemd-debuginfo-32bit-228-71.1 References: https://www.suse.com/security/cve/CVE-2018-6954.html https://www.suse.com/security/cve/CVE-2019-3842.html https://www.suse.com/security/cve/CVE-2019-6454.html https://bugzilla.suse.com/1080919 https://bugzilla.suse.com/1121563 https://bugzilla.suse.com/1125352 https://bugzilla.suse.com/1126056 https://bugzilla.suse.com/1127557 https://bugzilla.suse.com/1128657 https://bugzilla.suse.com/1130230 https://bugzilla.suse.com/1132348 https://bugzilla.suse.com/1132400 https://bugzilla.suse.com/1132721 https://bugzilla.suse.com/955942 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1453-1: moderate: Security update for evolution
by opensuse-security＠opensuse.org 27 May '19

27 May '19

openSUSE Security Update: Security update for evolution ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1453-1 Rating: moderate References: #1125230 Cross-References: CVE-2018-15587 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for evolution fixes the following issues: Security issue fixed: - CVE-2018-15587: Fixed an issue with spoofed pgp signatures by using specially crafted emails (bsc#1125230). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1453=1 Package List: - openSUSE Leap 15.0 (noarch): evolution-lang-3.26.6-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): evolution-3.26.6-lp150.3.3.1 evolution-debuginfo-3.26.6-lp150.3.3.1 evolution-debugsource-3.26.6-lp150.3.3.1 evolution-devel-3.26.6-lp150.3.3.1 evolution-plugin-bogofilter-3.26.6-lp150.3.3.1 evolution-plugin-bogofilter-debuginfo-3.26.6-lp150.3.3.1 evolution-plugin-pst-import-3.26.6-lp150.3.3.1 evolution-plugin-pst-import-debuginfo-3.26.6-lp150.3.3.1 evolution-plugin-spamassassin-3.26.6-lp150.3.3.1 evolution-plugin-spamassassin-debuginfo-3.26.6-lp150.3.3.1 glade-catalog-evolution-3.26.6-lp150.3.3.1 glade-catalog-evolution-debuginfo-3.26.6-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-15587.html https://bugzilla.suse.com/1125230 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1444-1: important: Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork
by opensuse-security＠opensuse.org 27 May '19

27 May '19

openSUSE Security Update: Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1444-1 Rating: important References: #1114209 #1114832 #1118897 #1118898 #1118899 #1121397 #1121967 #1123013 #1128376 #1128746 #1134068 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 CVE-2019-5736 CVE-2019-6486 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has 6 fixes is now available. Description: This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues: Security issues fixed: - CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967). - CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013). - CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897). - CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898). - CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899). Other changes and bug fixes: - Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068). - Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068). - Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068). - docker-test: Improvements to test packaging (bsc#1128746). - Move daemon.json file to /etc/docker directory (bsc#1114832). - Revert golang(API) removal since it turns out this breaks >= requires in certain cases (bsc#1114209). - Fix go build failures (bsc#1121397). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1444=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): go-1.12-lp151.2.3.1 go-doc-1.12-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): containerd-1.2.5-lp151.2.3.1 containerd-ctr-1.2.5-lp151.2.3.1 docker-18.09.6_ce-lp151.2.3.1 docker-debuginfo-18.09.6_ce-lp151.2.3.1 docker-debugsource-18.09.6_ce-lp151.2.3.1 docker-libnetwork-0.7.0.1+gitr2726_872f0a83c98a-lp151.2.3.1 docker-libnetwork-debuginfo-0.7.0.1+gitr2726_872f0a83c98a-lp151.2.3.1 docker-runc-1.0.0rc6+gitr3804_2b18fe1d885e-lp151.3.3.1 docker-runc-debuginfo-1.0.0rc6+gitr3804_2b18fe1d885e-lp151.3.3.1 docker-test-18.09.6_ce-lp151.2.3.1 docker-test-debuginfo-18.09.6_ce-lp151.2.3.1 go-race-1.12-lp151.2.3.1 go1.11-1.11.9-lp151.2.3.1 go1.11-doc-1.11.9-lp151.2.3.1 go1.11-race-1.11.9-lp151.2.3.1 go1.12-1.12.4-lp151.2.3.1 go1.12-doc-1.12.4-lp151.2.3.1 go1.12-race-1.12.4-lp151.2.3.1 golang-github-docker-libnetwork-0.7.0.1+gitr2726_872f0a83c98a-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): containerd-test-1.2.5-lp151.2.3.1 docker-bash-completion-18.09.6_ce-lp151.2.3.1 docker-runc-test-1.0.0rc6+gitr3804_2b18fe1d885e-lp151.3.3.1 docker-zsh-completion-18.09.6_ce-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://www.suse.com/security/cve/CVE-2019-5736.html https://www.suse.com/security/cve/CVE-2019-6486.html https://bugzilla.suse.com/1114209 https://bugzilla.suse.com/1114832 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899 https://bugzilla.suse.com/1121397 https://bugzilla.suse.com/1121967 https://bugzilla.suse.com/1123013 https://bugzilla.suse.com/1128376 https://bugzilla.suse.com/1128746 https://bugzilla.suse.com/1134068 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1439-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 23 May '19

23 May '19

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1439-1 Rating: important References: #1122293 #1122299 #1132728 #1132729 #1132732 #1133135 Cross-References: CVE-2018-11212 CVE-2018-3639 CVE-2019-2422 CVE-2019-2426 CVE-2019-2602 CVE-2019-2684 CVE-2019-2698 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk to version 8u212 fixes the following issues: Security issues fixed: - CVE-2019-2602: Better String parsing (bsc#1132728). - CVE-2019-2684: More dynamic RMI interactions (bsc#1132732). - CVE-2019-2698: Fuzzing TrueType fonts - setCurrGlyphID() (bsc#1132729). - CVE-2019-2422: Better FileChannel (bsc#1122293). - CVE-2018-11212: Improve JPEG (bsc#1122299). Non-Security issue fixed: - Disable LTO (bsc#1133135). - Added Japanese new era name. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1439=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_8_0-openjdk-1.8.0.212-34.1 java-1_8_0-openjdk-accessibility-1.8.0.212-34.1 java-1_8_0-openjdk-debuginfo-1.8.0.212-34.1 java-1_8_0-openjdk-debugsource-1.8.0.212-34.1 java-1_8_0-openjdk-demo-1.8.0.212-34.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.212-34.1 java-1_8_0-openjdk-devel-1.8.0.212-34.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.212-34.1 java-1_8_0-openjdk-headless-1.8.0.212-34.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.212-34.1 java-1_8_0-openjdk-src-1.8.0.212-34.1 - openSUSE Leap 42.3 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.212-34.1 References: https://www.suse.com/security/cve/CVE-2018-11212.html https://www.suse.com/security/cve/CVE-2018-3639.html https://www.suse.com/security/cve/CVE-2019-2422.html https://www.suse.com/security/cve/CVE-2019-2426.html https://www.suse.com/security/cve/CVE-2019-2602.html https://www.suse.com/security/cve/CVE-2019-2684.html https://www.suse.com/security/cve/CVE-2019-2698.html https://bugzilla.suse.com/1122293 https://bugzilla.suse.com/1122299 https://bugzilla.suse.com/1132728 https://bugzilla.suse.com/1132729 https://bugzilla.suse.com/1132732 https://bugzilla.suse.com/1133135 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1438-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 23 May '19

23 May '19

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1438-1 Rating: important References: #1132728 #1132729 #1132732 #1133135 Cross-References: CVE-2018-3639 CVE-2019-2602 CVE-2019-2684 CVE-2019-2698 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for java-1_8_0-openjdk to version 8u212 fixes the following issues: Security issues fixed: - CVE-2019-2602: Better String parsing (bsc#1132728). - CVE-2019-2684: More dynamic RMI interactions (bsc#1132732). - CVE-2019-2698: Fuzzing TrueType fonts - setCurrGlyphID() (bsc#1132729). - CVE-2018-3639: fix revision to prefer PR_SPEC_DISABLE_NOEXEC to PR_SPEC_DISABLE Non-Security issue fixed: - Disable LTO (bsc#1133135). - Added Japanese new era name. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1438=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): java-1_8_0-openjdk-1.8.0.212-lp150.2.16.1 java-1_8_0-openjdk-accessibility-1.8.0.212-lp150.2.16.1 java-1_8_0-openjdk-debuginfo-1.8.0.212-lp150.2.16.1 java-1_8_0-openjdk-debugsource-1.8.0.212-lp150.2.16.1 java-1_8_0-openjdk-demo-1.8.0.212-lp150.2.16.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.212-lp150.2.16.1 java-1_8_0-openjdk-devel-1.8.0.212-lp150.2.16.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.212-lp150.2.16.1 java-1_8_0-openjdk-headless-1.8.0.212-lp150.2.16.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.212-lp150.2.16.1 java-1_8_0-openjdk-src-1.8.0.212-lp150.2.16.1 - openSUSE Leap 15.0 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.212-lp150.2.16.1 References: https://www.suse.com/security/cve/CVE-2018-3639.html https://www.suse.com/security/cve/CVE-2019-2602.html https://www.suse.com/security/cve/CVE-2019-2684.html https://www.suse.com/security/cve/CVE-2019-2698.html https://bugzilla.suse.com/1132728 https://bugzilla.suse.com/1132729 https://bugzilla.suse.com/1132732 https://bugzilla.suse.com/1133135 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1436-1: important: Security update for chromium
by opensuse-security＠opensuse.org 22 May '19

22 May '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1436-1 Rating: important References: #1133313 Cross-References: CVE-2019-5805 CVE-2019-5806 CVE-2019-5807 CVE-2019-5808 CVE-2019-5809 CVE-2019-5810 CVE-2019-5811 CVE-2019-5812 CVE-2019-5813 CVE-2019-5814 CVE-2019-5815 CVE-2019-5816 CVE-2019-5817 CVE-2019-5818 CVE-2019-5819 CVE-2019-5820 CVE-2019-5821 CVE-2019-5822 CVE-2019-5823 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 19 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to 74.0.3729.108 boo#1133313: * CVE-2019-5805: Use after free in PDFium * CVE-2019-5806: Integer overflow in Angle * CVE-2019-5807: Memory corruption in V8 * CVE-2019-5808: Use after free in Blink * CVE-2019-5809: Use after free in Blink * CVE-2019-5810: User information disclosure in Autofill * CVE-2019-5811: CORS bypass in Blink * CVE-2019-5813: Out of bounds read in V8 * CVE-2019-5814: CORS bypass in Blink * CVE-2019-5815: Heap buffer overflow in Blink * CVE-2019-5818: Uninitialized value in media reader * CVE-2019-5819: Incorrect escaping in developer tools * CVE-2019-5820: Integer overflow in PDFium * CVE-2019-5821: Integer overflow in PDFium * CVE-2019-5822: CORS bypass in download manager * CVE-2019-5823: Forced navigation from service worker * CVE-2019-5812: URL spoof in Omnibox on iOS * CVE-2019-5816: Exploit persistence extension on Android * CVE-2019-5817: Heap buffer overflow in Angle on Windows - Update conditions to use system harfbuzz on TW+ - Require java during build - Enable using pipewire when available This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1436=1 Package List: - openSUSE Backports SLE-15 (x86_64): chromedriver-74.0.3729.108-bp150.207.1 chromium-74.0.3729.108-bp150.207.1 References: https://www.suse.com/security/cve/CVE-2019-5805.html https://www.suse.com/security/cve/CVE-2019-5806.html https://www.suse.com/security/cve/CVE-2019-5807.html https://www.suse.com/security/cve/CVE-2019-5808.html https://www.suse.com/security/cve/CVE-2019-5809.html https://www.suse.com/security/cve/CVE-2019-5810.html https://www.suse.com/security/cve/CVE-2019-5811.html https://www.suse.com/security/cve/CVE-2019-5812.html https://www.suse.com/security/cve/CVE-2019-5813.html https://www.suse.com/security/cve/CVE-2019-5814.html https://www.suse.com/security/cve/CVE-2019-5815.html https://www.suse.com/security/cve/CVE-2019-5816.html https://www.suse.com/security/cve/CVE-2019-5817.html https://www.suse.com/security/cve/CVE-2019-5818.html https://www.suse.com/security/cve/CVE-2019-5819.html https://www.suse.com/security/cve/CVE-2019-5820.html https://www.suse.com/security/cve/CVE-2019-5821.html https://www.suse.com/security/cve/CVE-2019-5822.html https://www.suse.com/security/cve/CVE-2019-5823.html https://bugzilla.suse.com/1133313 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1435-1: Security update for bzip2
by opensuse-security＠opensuse.org 22 May '19

22 May '19

openSUSE Security Update: Security update for bzip2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1435-1 Rating: low References: #985657 Cross-References: CVE-2016-3189 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bzip2 fixes the following issues: Security issue fixed: - CVE-2016-3189: Fixed a use-after-free in bzip2recover (bsc#985657). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1435=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): bzip2-1.0.6-lp151.5.3.1 bzip2-debuginfo-1.0.6-lp151.5.3.1 bzip2-debugsource-1.0.6-lp151.5.3.1 libbz2-1-1.0.6-lp151.5.3.1 libbz2-1-debuginfo-1.0.6-lp151.5.3.1 libbz2-devel-1.0.6-lp151.5.3.1 - openSUSE Leap 15.1 (x86_64): libbz2-1-32bit-1.0.6-lp151.5.3.1 libbz2-1-32bit-debuginfo-1.0.6-lp151.5.3.1 libbz2-devel-32bit-1.0.6-lp151.5.3.1 - openSUSE Leap 15.1 (noarch): bzip2-doc-1.0.6-lp151.5.3.1 References: https://www.suse.com/security/cve/CVE-2016-3189.html https://bugzilla.suse.com/985657 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1437-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 22 May '19

22 May '19

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1437-1 Rating: moderate References: #1132053 #1132054 #1133202 #1133203 #1133498 #1133501 Cross-References: CVE-2019-11008 CVE-2019-11009 CVE-2019-11473 CVE-2019-11474 CVE-2019-11505 CVE-2019-11506 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: Security issues fixed: - CVE-2019-11506: Fixed a heap-based buffer overflow in the function WriteMATLABImage (boo#1133498). - CVE-2019-11505: Fixed a heap-based buffer overflow in the function WritePDBImage (boo#1133501). The following fixes where modified and refreshed: - CVE-2019-11008: Fixed a heap-based buffer overflow in the function WriteXWDImage (boo#1132054). - CVE-2019-11009: Fixed a heap-based buffer over-read in the function ReadXWDImage (boo#1132053). - CVE-2019-11473: Fixed an out-of-bounds read leading to a possible denial of service in coders/xwd.c (boo#1133203). - CVE-2019-11474: Fixed a floating-point exception leading to a possible denial of service in coders/xwd.c (boo#1133202). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1437=1 Package List: - openSUSE Backports SLE-15 (x86_64): GraphicsMagick-1.3.29-bp150.2.21.1 GraphicsMagick-devel-1.3.29-bp150.2.21.1 libGraphicsMagick++-Q16-12-1.3.29-bp150.2.21.1 libGraphicsMagick++-devel-1.3.29-bp150.2.21.1 libGraphicsMagick-Q16-3-1.3.29-bp150.2.21.1 libGraphicsMagick3-config-1.3.29-bp150.2.21.1 libGraphicsMagickWand-Q16-2-1.3.29-bp150.2.21.1 perl-GraphicsMagick-1.3.29-bp150.2.21.1 References: https://www.suse.com/security/cve/CVE-2019-11008.html https://www.suse.com/security/cve/CVE-2019-11009.html https://www.suse.com/security/cve/CVE-2019-11473.html https://www.suse.com/security/cve/CVE-2019-11474.html https://www.suse.com/security/cve/CVE-2019-11505.html https://www.suse.com/security/cve/CVE-2019-11506.html https://bugzilla.suse.com/1132053 https://bugzilla.suse.com/1132054 https://bugzilla.suse.com/1133202 https://bugzilla.suse.com/1133203 https://bugzilla.suse.com/1133498 https://bugzilla.suse.com/1133501 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1434-1: moderate: Security update for graphviz
by opensuse-security＠opensuse.org 22 May '19

22 May '19

openSUSE Security Update: Security update for graphviz ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1434-1 Rating: moderate References: #1132091 Cross-References: CVE-2019-11023 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for graphviz fixes the following issues: Security issue fixed: - CVE-2019-11023: Fixed a denial of service vulnerability, which was caused by a NULL pointer dereference in agroot() (bsc#1132091). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1434=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): graphviz-2.40.1-lp151.6.3.1 graphviz-addons-debuginfo-2.40.1-lp151.6.3.1 graphviz-addons-debugsource-2.40.1-lp151.6.3.1 graphviz-debuginfo-2.40.1-lp151.6.3.1 graphviz-debugsource-2.40.1-lp151.6.3.1 graphviz-devel-2.40.1-lp151.6.3.1 graphviz-doc-2.40.1-lp151.6.3.1 graphviz-gd-2.40.1-lp151.6.3.1 graphviz-gd-debuginfo-2.40.1-lp151.6.3.1 graphviz-gnome-2.40.1-lp151.6.3.1 graphviz-gnome-debuginfo-2.40.1-lp151.6.3.1 graphviz-guile-2.40.1-lp151.6.3.1 graphviz-guile-debuginfo-2.40.1-lp151.6.3.1 graphviz-gvedit-2.40.1-lp151.6.3.1 graphviz-gvedit-debuginfo-2.40.1-lp151.6.3.1 graphviz-java-2.40.1-lp151.6.3.1 graphviz-java-debuginfo-2.40.1-lp151.6.3.1 graphviz-lua-2.40.1-lp151.6.3.1 graphviz-lua-debuginfo-2.40.1-lp151.6.3.1 graphviz-perl-2.40.1-lp151.6.3.1 graphviz-perl-debuginfo-2.40.1-lp151.6.3.1 graphviz-php-2.40.1-lp151.6.3.1 graphviz-php-debuginfo-2.40.1-lp151.6.3.1 graphviz-plugins-core-2.40.1-lp151.6.3.1 graphviz-plugins-core-debuginfo-2.40.1-lp151.6.3.1 graphviz-python-2.40.1-lp151.6.3.1 graphviz-python-debuginfo-2.40.1-lp151.6.3.1 graphviz-ruby-2.40.1-lp151.6.3.1 graphviz-ruby-debuginfo-2.40.1-lp151.6.3.1 graphviz-smyrna-2.40.1-lp151.6.3.1 graphviz-smyrna-debuginfo-2.40.1-lp151.6.3.1 graphviz-tcl-2.40.1-lp151.6.3.1 graphviz-tcl-debuginfo-2.40.1-lp151.6.3.1 libgraphviz6-2.40.1-lp151.6.3.1 libgraphviz6-debuginfo-2.40.1-lp151.6.3.1 References: https://www.suse.com/security/cve/CVE-2019-11023.html https://bugzilla.suse.com/1132091 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0