May 2019 - openSUSE Security Announce - openSUSE Mailing Lists

[security-announce] openSUSE-SU-2019:1397-1: important: Security update for 389-ds
by opensuse-security＠opensuse.org 15 May '19

15 May '19

openSUSE Security Update: Security update for 389-ds ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1397-1 Rating: important References: #1076530 #1096368 #1105606 #1106699 Cross-References: CVE-2017-15134 CVE-2017-15135 CVE-2018-10850 CVE-2018-10935 CVE-2018-14624 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for 389-ds fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-10850: Fixed a race condition on reference counter that would lead to a denial of service using persistent search (bsc#1096368) - CVE-2017-15134: Fixed a remote denial of service via search filters in slapi_filter_sprintf in slapd/util.c (bsc#1076530) - CVE-2017-15135: Fixed authentication bypass due to lack of size check in slapi_ct_memcmp function in ch_malloc.c (bsc#1076530) - CVE-2018-10935: Fixed an issue that allowed users to cause a crash via ldapsearch with server side sorts (bsc#1105606) - CVE-2018-14624: The lock controlling the error log was not correctly used when re-opening the log file in log__error_emergency(), allowing an attacker to send a flood of modifications to a very large DN, which could have caused slapd to crash (bsc#1106699). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1397=1 Package List: - openSUSE Leap 15.0 (x86_64): 389-ds-1.4.0.3-lp150.3.3.1 389-ds-debuginfo-1.4.0.3-lp150.3.3.1 389-ds-debugsource-1.4.0.3-lp150.3.3.1 389-ds-devel-1.4.0.3-lp150.3.3.1 389-ds-snmp-1.4.0.3-lp150.3.3.1 389-ds-snmp-debuginfo-1.4.0.3-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2017-15134.html https://www.suse.com/security/cve/CVE-2017-15135.html https://www.suse.com/security/cve/CVE-2018-10850.html https://www.suse.com/security/cve/CVE-2018-10935.html https://www.suse.com/security/cve/CVE-2018-14624.html https://bugzilla.suse.com/1076530 https://bugzilla.suse.com/1096368 https://bugzilla.suse.com/1105606 https://bugzilla.suse.com/1106699 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1394-1: important: Security update for freeradius-server
by opensuse-security＠opensuse.org 13 May '19

13 May '19

openSUSE Security Update: Security update for freeradius-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1394-1 Rating: important References: #1132549 #1132664 Cross-References: CVE-2019-11234 CVE-2019-11235 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for freeradius-server fixes the following issues: Security issues fixed: - CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points (bsc#1132549). - CVE-2019-11234: Fixed an authentication bypass caused by reflecting privous values back to the server (bsc#1132664). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1394=1 Package List: - openSUSE Leap 42.3 (x86_64): freeradius-server-3.0.15-9.1 freeradius-server-debuginfo-3.0.15-9.1 freeradius-server-debugsource-3.0.15-9.1 freeradius-server-devel-3.0.15-9.1 freeradius-server-doc-3.0.15-9.1 freeradius-server-krb5-3.0.15-9.1 freeradius-server-krb5-debuginfo-3.0.15-9.1 freeradius-server-ldap-3.0.15-9.1 freeradius-server-ldap-debuginfo-3.0.15-9.1 freeradius-server-libs-3.0.15-9.1 freeradius-server-libs-debuginfo-3.0.15-9.1 freeradius-server-mysql-3.0.15-9.1 freeradius-server-mysql-debuginfo-3.0.15-9.1 freeradius-server-perl-3.0.15-9.1 freeradius-server-perl-debuginfo-3.0.15-9.1 freeradius-server-postgresql-3.0.15-9.1 freeradius-server-postgresql-debuginfo-3.0.15-9.1 freeradius-server-python-3.0.15-9.1 freeradius-server-python-debuginfo-3.0.15-9.1 freeradius-server-sqlite-3.0.15-9.1 freeradius-server-sqlite-debuginfo-3.0.15-9.1 freeradius-server-utils-3.0.15-9.1 freeradius-server-utils-debuginfo-3.0.15-9.1 References: https://www.suse.com/security/cve/CVE-2019-11234.html https://www.suse.com/security/cve/CVE-2019-11235.html https://bugzilla.suse.com/1132549 https://bugzilla.suse.com/1132664 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1391-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 13 May '19

13 May '19

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1391-1 Rating: important References: #1132256 Cross-References: CVE-2019-11070 CVE-2019-6201 CVE-2019-6251 CVE-2019-7285 CVE-2019-7292 CVE-2019-8503 CVE-2019-8506 CVE-2019-8515 CVE-2019-8524 CVE-2019-8535 CVE-2019-8536 CVE-2019-8544 CVE-2019-8551 CVE-2019-8558 CVE-2019-8559 CVE-2019-8563 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for webkit2gtk3 to version 2.24.1 fixes the following issues: Security issues fixed: - CVE-2019-6201, CVE-2019-6251, CVE-2019-7285, CVE-2019-7292, CVE-2019-8503, CVE-2019-8506, CVE-2019-8515, CVE-2019-8524, CVE-2019-8535, CVE-2019-8536, CVE-2019-8544, CVE-2019-8551, CVE-2019-8558, CVE-2019-8559, CVE-2019-8563, CVE-2019-11070 (bsc#1132256). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1391=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.24.1-27.1 libjavascriptcoregtk-4_0-18-debuginfo-2.24.1-27.1 libwebkit2gtk-4_0-37-2.24.1-27.1 libwebkit2gtk-4_0-37-debuginfo-2.24.1-27.1 typelib-1_0-JavaScriptCore-4_0-2.24.1-27.1 typelib-1_0-WebKit2-4_0-2.24.1-27.1 typelib-1_0-WebKit2WebExtension-4_0-2.24.1-27.1 webkit-jsc-4-2.24.1-27.1 webkit-jsc-4-debuginfo-2.24.1-27.1 webkit2gtk-4_0-injected-bundles-2.24.1-27.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.24.1-27.1 webkit2gtk3-debugsource-2.24.1-27.1 webkit2gtk3-devel-2.24.1-27.1 webkit2gtk3-minibrowser-2.24.1-27.1 webkit2gtk3-minibrowser-debuginfo-2.24.1-27.1 webkit2gtk3-plugin-process-gtk2-2.24.1-27.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.24.1-27.1 - openSUSE Leap 42.3 (noarch): libwebkit2gtk3-lang-2.24.1-27.1 - openSUSE Leap 42.3 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.24.1-27.1 libjavascriptcoregtk-4_0-18-debuginfo-32bit-2.24.1-27.1 libwebkit2gtk-4_0-37-32bit-2.24.1-27.1 libwebkit2gtk-4_0-37-debuginfo-32bit-2.24.1-27.1 References: https://www.suse.com/security/cve/CVE-2019-11070.html https://www.suse.com/security/cve/CVE-2019-6201.html https://www.suse.com/security/cve/CVE-2019-6251.html https://www.suse.com/security/cve/CVE-2019-7285.html https://www.suse.com/security/cve/CVE-2019-7292.html https://www.suse.com/security/cve/CVE-2019-8503.html https://www.suse.com/security/cve/CVE-2019-8506.html https://www.suse.com/security/cve/CVE-2019-8515.html https://www.suse.com/security/cve/CVE-2019-8524.html https://www.suse.com/security/cve/CVE-2019-8535.html https://www.suse.com/security/cve/CVE-2019-8536.html https://www.suse.com/security/cve/CVE-2019-8544.html https://www.suse.com/security/cve/CVE-2019-8551.html https://www.suse.com/security/cve/CVE-2019-8558.html https://www.suse.com/security/cve/CVE-2019-8559.html https://www.suse.com/security/cve/CVE-2019-8563.html https://bugzilla.suse.com/1132256 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1395-1: important: Security update for python-Jinja2
by opensuse-security＠opensuse.org 13 May '19

13 May '19

openSUSE Security Update: Security update for python-Jinja2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1395-1 Rating: important References: #1125815 #1132174 #1132323 Cross-References: CVE-2016-10745 CVE-2019-10906 CVE-2019-8341 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for python-Jinja2 to version 2.10.1 fixes the following issues: Security issues fixed: - CVE-2019-8341: Fixed a command injection in from_string() (bsc#1125815). - CVE-2019-10906: Fixed a sandbox escape due to information disclosure via str.format (bsc#1132323). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1395=1 Package List: - openSUSE Leap 15.0 (noarch): python-Jinja2-emacs-2.10.1-lp150.2.3.1 python-Jinja2-vim-2.10.1-lp150.2.3.1 python2-Jinja2-2.10.1-lp150.2.3.1 python3-Jinja2-2.10.1-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2016-10745.html https://www.suse.com/security/cve/CVE-2019-10906.html https://www.suse.com/security/cve/CVE-2019-8341.html https://bugzilla.suse.com/1125815 https://bugzilla.suse.com/1132174 https://bugzilla.suse.com/1132323 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1388-1: moderate: Security update for signing-party
by opensuse-security＠opensuse.org 13 May '19

13 May '19

openSUSE Security Update: Security update for signing-party ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1388-1 Rating: moderate References: #1134040 Cross-References: CVE-2019-11627 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for signing-party fixes the following issues: - CVE-2019-11627: The gpg-key2ps tool in signing-party contained an unsafe shell call enabling shell injection via a User ID. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1388=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1388=1 Package List: - openSUSE Leap 42.3 (noarch): signing-party-2.1-10.3.1 - openSUSE Leap 15.0 (x86_64): signing-party-2.7-lp150.5.1 signing-party-debuginfo-2.7-lp150.5.1 signing-party-debugsource-2.7-lp150.5.1 References: https://www.suse.com/security/cve/CVE-2019-11627.html https://bugzilla.suse.com/1134040 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1392-1: Security update for nmap
by opensuse-security＠opensuse.org 13 May '19

13 May '19

openSUSE Security Update: Security update for nmap ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1392-1 Rating: low References: #1104139 Cross-References: CVE-2018-15173 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nmap fixes the following issues: Security issue fixed: - CVE-2018-15173: Fixed remote denial of service via a crafted TCP-based service (boo#1104139). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1392=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ncat-6.47-13.3.1 ndiff-6.47-13.3.1 nmap-6.47-13.3.1 nmap-debuginfo-6.47-13.3.1 nmap-debugsource-6.47-13.3.1 nping-6.47-13.3.1 zenmap-6.47-13.3.1 References: https://www.suse.com/security/cve/CVE-2018-15173.html https://bugzilla.suse.com/1104139 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1390-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 13 May '19

13 May '19

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1390-1 Rating: moderate References: #1127367 #1127369 #1127370 #1131945 Cross-References: CVE-2019-10894 CVE-2019-10895 CVE-2019-10896 CVE-2019-10899 CVE-2019-10901 CVE-2019-10903 CVE-2019-9208 CVE-2019-9209 CVE-2019-9214 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for wireshark to version 2.4.14 fixes the following issues: Security issues fixed: - CVE-2019-10895: NetScaler file parser crash. - CVE-2019-10899: SRVLOC dissector crash. - CVE-2019-10894: GSS-API dissector crash. - CVE-2019-10896: DOF dissector crash. - CVE-2019-10901: LDSS dissector crash. - CVE-2019-10903: DCERPC SPOOLSS dissector crash. - CVE-2019-9214: Avoided a dereference of a null coversation which could make RPCAP dissector crash (bsc#1127367). - CVE-2019-9209: Fixed a buffer overflow in time values which could make ASN.1 BER and related dissectors crash (bsc#1127369). - CVE-2019-9208: Fixed a null pointer dereference which could make TCAP dissector crash (bsc#1127370). Non-security issue fixed: - Update to version 2.4.14 (bsc#1131945). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1390=1 Package List: - openSUSE Leap 42.3 (x86_64): libwireshark9-2.4.14-52.1 libwireshark9-debuginfo-2.4.14-52.1 libwiretap7-2.4.14-52.1 libwiretap7-debuginfo-2.4.14-52.1 libwscodecs1-2.4.14-52.1 libwscodecs1-debuginfo-2.4.14-52.1 libwsutil8-2.4.14-52.1 libwsutil8-debuginfo-2.4.14-52.1 wireshark-2.4.14-52.1 wireshark-debuginfo-2.4.14-52.1 wireshark-debugsource-2.4.14-52.1 wireshark-devel-2.4.14-52.1 wireshark-gtk-2.4.14-52.1 wireshark-gtk-debuginfo-2.4.14-52.1 wireshark-ui-qt-2.4.14-52.1 wireshark-ui-qt-debuginfo-2.4.14-52.1 References: https://www.suse.com/security/cve/CVE-2019-10894.html https://www.suse.com/security/cve/CVE-2019-10895.html https://www.suse.com/security/cve/CVE-2019-10896.html https://www.suse.com/security/cve/CVE-2019-10899.html https://www.suse.com/security/cve/CVE-2019-10901.html https://www.suse.com/security/cve/CVE-2019-10903.html https://www.suse.com/security/cve/CVE-2019-9208.html https://www.suse.com/security/cve/CVE-2019-9209.html https://www.suse.com/security/cve/CVE-2019-9214.html https://bugzilla.suse.com/1127367 https://bugzilla.suse.com/1127369 https://bugzilla.suse.com/1127370 https://bugzilla.suse.com/1131945 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1372-1: moderate: Security update for sqlite3
by opensuse-security＠opensuse.org 10 May '19

10 May '19

openSUSE Security Update: Security update for sqlite3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1372-1 Rating: moderate References: #1130325 #1130326 Cross-References: CVE-2019-9936 CVE-2019-9937 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for sqlite3 to version 3.28.0 fixes the following issues: Security issues fixed: - CVE-2019-9936: Fixed a heap-based buffer over-read, when running fts5 prefix queries inside transaction (bsc#1130326). - CVE-2019-9937: Fixed a denial of service related to interleaving reads and writes in a single transaction with an fts5 virtual table (bsc#1130325). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1372=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libsqlite3-0-3.28.0-lp150.2.6.1 libsqlite3-0-debuginfo-3.28.0-lp150.2.6.1 sqlite3-3.28.0-lp150.2.6.1 sqlite3-debuginfo-3.28.0-lp150.2.6.1 sqlite3-debugsource-3.28.0-lp150.2.6.1 sqlite3-devel-3.28.0-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libsqlite3-0-32bit-3.28.0-lp150.2.6.1 libsqlite3-0-32bit-debuginfo-3.28.0-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): sqlite3-doc-3.28.0-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-9936.html https://www.suse.com/security/cve/CVE-2019-9937.html https://bugzilla.suse.com/1130325 https://bugzilla.suse.com/1130326 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1374-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 10 May '19

10 May '19

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1374-1 Rating: important References: #1132256 Cross-References: CVE-2019-11070 CVE-2019-6201 CVE-2019-6251 CVE-2019-7285 CVE-2019-7292 CVE-2019-8503 CVE-2019-8506 CVE-2019-8515 CVE-2019-8518 CVE-2019-8523 CVE-2019-8524 CVE-2019-8535 CVE-2019-8536 CVE-2019-8544 CVE-2019-8551 CVE-2019-8558 CVE-2019-8559 CVE-2019-8563 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: This update for webkit2gtk3 to version 2.24.1 fixes the following issues: Security issues fixed: - CVE-2019-6201, CVE-2019-6251, CVE-2019-7285, CVE-2019-7292, CVE-2019-8503, CVE-2019-8506, CVE-2019-8515, CVE-2019-8518, CVE-2019-8523, CVE-2019-8524, CVE-2019-8535, CVE-2019-8536, CVE-2019-8544, CVE-2019-8551, CVE-2019-8558, CVE-2019-8559, CVE-2019-8563, CVE-2019-11070 (bsc#1132256). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1374=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.24.1-lp150.2.19.1 libjavascriptcoregtk-4_0-18-debuginfo-2.24.1-lp150.2.19.1 libwebkit2gtk-4_0-37-2.24.1-lp150.2.19.1 libwebkit2gtk-4_0-37-debuginfo-2.24.1-lp150.2.19.1 typelib-1_0-JavaScriptCore-4_0-2.24.1-lp150.2.19.1 typelib-1_0-WebKit2-4_0-2.24.1-lp150.2.19.1 typelib-1_0-WebKit2WebExtension-4_0-2.24.1-lp150.2.19.1 webkit-jsc-4-2.24.1-lp150.2.19.1 webkit-jsc-4-debuginfo-2.24.1-lp150.2.19.1 webkit2gtk-4_0-injected-bundles-2.24.1-lp150.2.19.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.24.1-lp150.2.19.1 webkit2gtk3-debugsource-2.24.1-lp150.2.19.1 webkit2gtk3-devel-2.24.1-lp150.2.19.1 webkit2gtk3-minibrowser-2.24.1-lp150.2.19.1 webkit2gtk3-minibrowser-debuginfo-2.24.1-lp150.2.19.1 webkit2gtk3-plugin-process-gtk2-2.24.1-lp150.2.19.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.24.1-lp150.2.19.1 - openSUSE Leap 15.0 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.24.1-lp150.2.19.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.24.1-lp150.2.19.1 libwebkit2gtk-4_0-37-32bit-2.24.1-lp150.2.19.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.24.1-lp150.2.19.1 - openSUSE Leap 15.0 (noarch): libwebkit2gtk3-lang-2.24.1-lp150.2.19.1 References: https://www.suse.com/security/cve/CVE-2019-11070.html https://www.suse.com/security/cve/CVE-2019-6201.html https://www.suse.com/security/cve/CVE-2019-6251.html https://www.suse.com/security/cve/CVE-2019-7285.html https://www.suse.com/security/cve/CVE-2019-7292.html https://www.suse.com/security/cve/CVE-2019-8503.html https://www.suse.com/security/cve/CVE-2019-8506.html https://www.suse.com/security/cve/CVE-2019-8515.html https://www.suse.com/security/cve/CVE-2019-8518.html https://www.suse.com/security/cve/CVE-2019-8523.html https://www.suse.com/security/cve/CVE-2019-8524.html https://www.suse.com/security/cve/CVE-2019-8535.html https://www.suse.com/security/cve/CVE-2019-8536.html https://www.suse.com/security/cve/CVE-2019-8544.html https://www.suse.com/security/cve/CVE-2019-8551.html https://www.suse.com/security/cve/CVE-2019-8558.html https://www.suse.com/security/cve/CVE-2019-8559.html https://www.suse.com/security/cve/CVE-2019-8563.html https://bugzilla.suse.com/1132256 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1371-1: important: Security update for python3
by opensuse-security＠opensuse.org 10 May '19

10 May '19

openSUSE Security Update: Security update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1371-1 Rating: important References: #1129346 Cross-References: CVE-2019-9636 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python3 fixes the following issues: Security issue fixed: - CVE-2019-9636: Fixed an information disclosure because of incorrect handling of Unicode encoding during NFKC normalization (bsc#1129346). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1371=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libpython3_4m1_0-3.4.6-12.10.1 libpython3_4m1_0-debuginfo-3.4.6-12.10.1 python3-3.4.6-12.10.2 python3-base-3.4.6-12.10.1 python3-base-debuginfo-3.4.6-12.10.1 python3-base-debugsource-3.4.6-12.10.1 python3-curses-3.4.6-12.10.2 python3-curses-debuginfo-3.4.6-12.10.2 python3-dbm-3.4.6-12.10.2 python3-dbm-debuginfo-3.4.6-12.10.2 python3-debuginfo-3.4.6-12.10.2 python3-debugsource-3.4.6-12.10.2 python3-devel-3.4.6-12.10.1 python3-devel-debuginfo-3.4.6-12.10.1 python3-idle-3.4.6-12.10.1 python3-testsuite-3.4.6-12.10.1 python3-testsuite-debuginfo-3.4.6-12.10.1 python3-tk-3.4.6-12.10.2 python3-tk-debuginfo-3.4.6-12.10.2 python3-tools-3.4.6-12.10.1 - openSUSE Leap 42.3 (x86_64): libpython3_4m1_0-32bit-3.4.6-12.10.1 libpython3_4m1_0-debuginfo-32bit-3.4.6-12.10.1 python3-32bit-3.4.6-12.10.2 python3-base-32bit-3.4.6-12.10.1 python3-base-debuginfo-32bit-3.4.6-12.10.1 python3-debuginfo-32bit-3.4.6-12.10.2 References: https://www.suse.com/security/cve/CVE-2019-9636.html https://bugzilla.suse.com/1129346 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0