June 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:1526-1: moderate: Security update for axis
by opensuse-security＠opensuse.org 07 Jun '19

07 Jun '19

openSUSE Security Update: Security update for axis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1526-1 Rating: moderate References: #1134598 Cross-References: CVE-2012-5784 CVE-2014-3596 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for axis fixes the following issues: Security issue fixed: - CVE-2012-5784, CVE-2014-3596: Fixed missing connection hostname check against X.509 certificate name (bsc#1134598). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1526=1 Package List: - openSUSE Leap 42.3 (noarch): axis-1.4-300.1 axis-javadoc-1.4-300.1 axis-manual-1.4-300.1 References: https://www.suse.com/security/cve/CVE-2012-5784.html https://www.suse.com/security/cve/CVE-2014-3596.html https://bugzilla.suse.com/1134598 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1530-1: Security update for libpng16
by opensuse-security＠opensuse.org 07 Jun '19

07 Jun '19

openSUSE Security Update: Security update for libpng16 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1530-1 Rating: low References: #1100687 #1121624 #1124211 Cross-References: CVE-2018-13785 CVE-2019-7317 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for libpng16 fixes the following issues: Security issues fixed: - CVE-2019-7317: Fixed a use-after-free vulnerability, triggered when png_image_free() was called under png_safe_execute (bsc#1124211). - CVE-2018-13785: Fixed a wrong calculation of row_factor in the png_check_chunk_length function in pngrutil.c, which could haved triggered and integer overflow and result in an divide-by-zero while processing a crafted PNG file, leading to a denial of service (bsc#1100687) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1530=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1530=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpng16-16-1.6.34-lp151.3.3.1 libpng16-16-debuginfo-1.6.34-lp151.3.3.1 libpng16-compat-devel-1.6.34-lp151.3.3.1 libpng16-debugsource-1.6.34-lp151.3.3.1 libpng16-devel-1.6.34-lp151.3.3.1 libpng16-tools-1.6.34-lp151.3.3.1 libpng16-tools-debuginfo-1.6.34-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libpng16-16-32bit-1.6.34-lp151.3.3.1 libpng16-16-32bit-debuginfo-1.6.34-lp151.3.3.1 libpng16-compat-devel-32bit-1.6.34-lp151.3.3.1 libpng16-devel-32bit-1.6.34-lp151.3.3.1 - openSUSE Leap 15.0 (i586 x86_64): libpng16-16-1.6.34-lp150.2.3.1 libpng16-16-debuginfo-1.6.34-lp150.2.3.1 libpng16-compat-devel-1.6.34-lp150.2.3.1 libpng16-debugsource-1.6.34-lp150.2.3.1 libpng16-devel-1.6.34-lp150.2.3.1 libpng16-tools-1.6.34-lp150.2.3.1 libpng16-tools-debuginfo-1.6.34-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libpng16-16-32bit-1.6.34-lp150.2.3.1 libpng16-16-32bit-debuginfo-1.6.34-lp150.2.3.1 libpng16-compat-devel-32bit-1.6.34-lp150.2.3.1 libpng16-devel-32bit-1.6.34-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-13785.html https://www.suse.com/security/cve/CVE-2019-7317.html https://bugzilla.suse.com/1100687 https://bugzilla.suse.com/1121624 https://bugzilla.suse.com/1124211 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1524-1: important: Security update exim
by opensuse-security＠opensuse.org 07 Jun '19

07 Jun '19

openSUSE Security Update: Security update exim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1524-1 Rating: important References: #1136587 Cross-References: CVE-2019-10149 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: exim was updated to fix a security issue. - CVE-2019-10149: Fixed a Remote Command Execution in exim (bsc#1136587) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1524=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1524=1 Package List: - openSUSE Leap 15.1 (x86_64): exim-4.88-lp151.4.3.1 exim-debuginfo-4.88-lp151.4.3.1 exim-debugsource-4.88-lp151.4.3.1 eximon-4.88-lp151.4.3.1 eximon-debuginfo-4.88-lp151.4.3.1 eximstats-html-4.88-lp151.4.3.1 - openSUSE Leap 15.0 (x86_64): exim-4.88-lp150.3.3.1 exim-debuginfo-4.88-lp150.3.3.1 exim-debugsource-4.88-lp150.3.3.1 eximon-4.88-lp150.3.3.1 eximon-debuginfo-4.88-lp150.3.3.1 eximstats-html-4.88-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-10149.html https://bugzilla.suse.com/1136587 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1520-1: Security update for cronie
by opensuse-security＠opensuse.org 05 Jun '19

05 Jun '19

openSUSE Security Update: Security update for cronie ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1520-1 Rating: low References: #1128935 #1128937 #1130746 #1133100 Cross-References: CVE-2019-9704 CVE-2019-9705 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for cronie fixes the following issues: Security issues fixed: - CVE-2019-9704: Fixed an insufficient check in the return value of calloc which could allow a local user to create Denial of Service by crashing the daemon (bsc#1128937). - CVE-2019-9705: Fixed an implementation vulnerability which could allow a local user to exhaust the memory resulting in Denial of Service (bsc#1128935). Bug fixes: - Manual start of cron is possible even when it's already started using systemd (bsc#1133100). - Cron schedules only one job of crontab (bsc#1130746). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1520=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1520=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): cron-4.2-lp151.4.3.1 cronie-1.5.1-lp151.4.3.1 cronie-anacron-1.5.1-lp151.4.3.1 cronie-anacron-debuginfo-1.5.1-lp151.4.3.1 cronie-debuginfo-1.5.1-lp151.4.3.1 cronie-debugsource-1.5.1-lp151.4.3.1 - openSUSE Leap 15.0 (i586 x86_64): cron-4.2-lp150.3.3.1 cronie-1.5.1-lp150.3.3.1 cronie-anacron-1.5.1-lp150.3.3.1 cronie-anacron-debuginfo-1.5.1-lp150.3.3.1 cronie-debuginfo-1.5.1-lp150.3.3.1 cronie-debugsource-1.5.1-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-9704.html https://www.suse.com/security/cve/CVE-2019-9705.html https://bugzilla.suse.com/1128935 https://bugzilla.suse.com/1128937 https://bugzilla.suse.com/1130746 https://bugzilla.suse.com/1133100 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1510-1: moderate: Security update for libtasn1
by opensuse-security＠opensuse.org 05 Jun '19

05 Jun '19

openSUSE Security Update: Security update for libtasn1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1510-1 Rating: moderate References: #1040621 #1105435 Cross-References: CVE-2017-6891 CVE-2018-1000654 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libtasn1 fixes the following issues: Security issues fixed: - CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435). - CVE-2017-6891: Fixed a stack overflow in asn1_find_node() (bsc#1040621). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1510=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libtasn1-4.9-6.1 libtasn1-6-4.9-6.1 libtasn1-6-debuginfo-4.9-6.1 libtasn1-debuginfo-4.9-6.1 libtasn1-debugsource-4.9-6.1 libtasn1-devel-4.9-6.1 - openSUSE Leap 42.3 (x86_64): libtasn1-6-32bit-4.9-6.1 libtasn1-6-debuginfo-32bit-4.9-6.1 libtasn1-devel-32bit-4.9-6.1 References: https://www.suse.com/security/cve/CVE-2017-6891.html https://www.suse.com/security/cve/CVE-2018-1000654.html https://bugzilla.suse.com/1040621 https://bugzilla.suse.com/1105435 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1508-1: important: Security update for curl
by opensuse-security＠opensuse.org 04 Jun '19

04 Jun '19

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1508-1 Rating: important References: #1135170 Cross-References: CVE-2019-5436 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for curl fixes the following issues: Security issue fixed: - CVE-2019-5436: Fixed a heap buffer overflow exists in tftp_receive_packet that receives data from a TFTP server (bsc#1135170). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1508=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1508=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): curl-7.60.0-lp151.5.3.1 curl-debuginfo-7.60.0-lp151.5.3.1 curl-debugsource-7.60.0-lp151.5.3.1 curl-mini-7.60.0-lp151.5.3.1 curl-mini-debuginfo-7.60.0-lp151.5.3.1 curl-mini-debugsource-7.60.0-lp151.5.3.1 libcurl-devel-7.60.0-lp151.5.3.1 libcurl-mini-devel-7.60.0-lp151.5.3.1 libcurl4-7.60.0-lp151.5.3.1 libcurl4-debuginfo-7.60.0-lp151.5.3.1 libcurl4-mini-7.60.0-lp151.5.3.1 libcurl4-mini-debuginfo-7.60.0-lp151.5.3.1 - openSUSE Leap 15.1 (x86_64): libcurl-devel-32bit-7.60.0-lp151.5.3.1 libcurl4-32bit-7.60.0-lp151.5.3.1 libcurl4-32bit-debuginfo-7.60.0-lp151.5.3.1 - openSUSE Leap 15.0 (i586 x86_64): curl-7.60.0-lp150.2.22.1 curl-debuginfo-7.60.0-lp150.2.22.1 curl-debugsource-7.60.0-lp150.2.22.1 libcurl-devel-7.60.0-lp150.2.22.1 libcurl4-7.60.0-lp150.2.22.1 libcurl4-debuginfo-7.60.0-lp150.2.22.1 - openSUSE Leap 15.0 (x86_64): libcurl-devel-32bit-7.60.0-lp150.2.22.1 libcurl4-32bit-7.60.0-lp150.2.22.1 libcurl4-32bit-debuginfo-7.60.0-lp150.2.22.1 References: https://www.suse.com/security/cve/CVE-2019-5436.html https://bugzilla.suse.com/1135170 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1507-1: moderate: Recommended update for GraphicsMagick
by opensuse-security＠opensuse.org 04 Jun '19

04 Jun '19

openSUSE Security Update: Recommended update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1507-1 Rating: moderate References: #1136183 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for GraphicsMagick fixes the following issues: Changes in GraphicsMagick: - disable also PCL decoding by default, as it is also passed through ghostscript (boo#1136183) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1507=1 Package List: - openSUSE Backports SLE-15 (x86_64): GraphicsMagick-1.3.29-bp150.2.24.1 GraphicsMagick-devel-1.3.29-bp150.2.24.1 libGraphicsMagick++-Q16-12-1.3.29-bp150.2.24.1 libGraphicsMagick++-devel-1.3.29-bp150.2.24.1 libGraphicsMagick-Q16-3-1.3.29-bp150.2.24.1 libGraphicsMagick3-config-1.3.29-bp150.2.24.1 libGraphicsMagickWand-Q16-2-1.3.29-bp150.2.24.1 perl-GraphicsMagick-1.3.29-bp150.2.24.1 References: https://bugzilla.suse.com/1136183 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1506-1: important: Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork
by opensuse-security＠opensuse.org 03 Jun '19

03 Jun '19

openSUSE Security Update: Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1506-1 Rating: important References: #1114209 #1114832 #1118897 #1118898 #1118899 #1121397 #1121967 #1123013 #1128376 #1128746 #1134068 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 CVE-2019-5736 CVE-2019-6486 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has 6 fixes is now available. Description: This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues: Security issues fixed: - CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967). - CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013). - CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897). - CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898). - CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899). Other changes and bug fixes: - Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068). - Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068). - Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068). - docker-test: Improvements to test packaging (bsc#1128746). - Move daemon.json file to /etc/docker directory (bsc#1114832). - Revert golang(API) removal since it turns out this breaks >= requires in certain cases (bsc#1114209). - Fix go build failures (bsc#1121397). This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1506=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): go-1.12-bp150.2.6.1 go-doc-1.12-bp150.2.6.1 - openSUSE Backports SLE-15 (x86_64): go-race-1.12-bp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://www.suse.com/security/cve/CVE-2019-5736.html https://www.suse.com/security/cve/CVE-2019-6486.html https://bugzilla.suse.com/1114209 https://bugzilla.suse.com/1114832 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899 https://bugzilla.suse.com/1121397 https://bugzilla.suse.com/1121967 https://bugzilla.suse.com/1123013 https://bugzilla.suse.com/1128376 https://bugzilla.suse.com/1128746 https://bugzilla.suse.com/1134068 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1505-1: important: Security update for libvirt
by opensuse-security＠opensuse.org 03 Jun '19

03 Jun '19

openSUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1505-1 Rating: important References: #1111331 #1135273 Cross-References: CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libvirt fixes the following issues: Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331) - CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS) - CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS) - CVE-2018-12130: Microarchitectural Load Port Data Sampling (MLPDS) - CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM) These updates contain the libvirt adjustments, that pass through the new 'md-clear' CPU flag (bsc#1135273). For more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1505=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libvirt-4.0.0-lp150.7.14.1 libvirt-admin-4.0.0-lp150.7.14.1 libvirt-admin-debuginfo-4.0.0-lp150.7.14.1 libvirt-client-4.0.0-lp150.7.14.1 libvirt-client-debuginfo-4.0.0-lp150.7.14.1 libvirt-daemon-4.0.0-lp150.7.14.1 libvirt-daemon-config-network-4.0.0-lp150.7.14.1 libvirt-daemon-config-nwfilter-4.0.0-lp150.7.14.1 libvirt-daemon-debuginfo-4.0.0-lp150.7.14.1 libvirt-daemon-driver-interface-4.0.0-lp150.7.14.1 libvirt-daemon-driver-interface-debuginfo-4.0.0-lp150.7.14.1 libvirt-daemon-driver-lxc-4.0.0-lp150.7.14.1 libvirt-daemon-driver-lxc-debuginfo-4.0.0-lp150.7.14.1 libvirt-daemon-driver-network-4.0.0-lp150.7.14.1 libvirt-daemon-driver-network-debuginfo-4.0.0-lp150.7.14.1 libvirt-daemon-driver-nodedev-4.0.0-lp150.7.14.1 libvirt-daemon-driver-nodedev-debuginfo-4.0.0-lp150.7.14.1 libvirt-daemon-driver-nwfilter-4.0.0-lp150.7.14.1 libvirt-daemon-driver-nwfilter-debuginfo-4.0.0-lp150.7.14.1 libvirt-daemon-driver-qemu-4.0.0-lp150.7.14.1 libvirt-daemon-driver-qemu-debuginfo-4.0.0-lp150.7.14.1 libvirt-daemon-driver-secret-4.0.0-lp150.7.14.1 libvirt-daemon-driver-secret-debuginfo-4.0.0-lp150.7.14.1 libvirt-daemon-driver-storage-4.0.0-lp150.7.14.1 libvirt-daemon-driver-storage-core-4.0.0-lp150.7.14.1 libvirt-daemon-driver-storage-core-debuginfo-4.0.0-lp150.7.14.1 libvirt-daemon-driver-storage-disk-4.0.0-lp150.7.14.1 libvirt-daemon-driver-storage-disk-debuginfo-4.0.0-lp150.7.14.1 libvirt-daemon-driver-storage-iscsi-4.0.0-lp150.7.14.1 libvirt-daemon-driver-storage-iscsi-debuginfo-4.0.0-lp150.7.14.1 libvirt-daemon-driver-storage-logical-4.0.0-lp150.7.14.1 libvirt-daemon-driver-storage-logical-debuginfo-4.0.0-lp150.7.14.1 libvirt-daemon-driver-storage-mpath-4.0.0-lp150.7.14.1 libvirt-daemon-driver-storage-mpath-debuginfo-4.0.0-lp150.7.14.1 libvirt-daemon-driver-storage-scsi-4.0.0-lp150.7.14.1 libvirt-daemon-driver-storage-scsi-debuginfo-4.0.0-lp150.7.14.1 libvirt-daemon-driver-uml-4.0.0-lp150.7.14.1 libvirt-daemon-driver-uml-debuginfo-4.0.0-lp150.7.14.1 libvirt-daemon-driver-vbox-4.0.0-lp150.7.14.1 libvirt-daemon-driver-vbox-debuginfo-4.0.0-lp150.7.14.1 libvirt-daemon-hooks-4.0.0-lp150.7.14.1 libvirt-daemon-lxc-4.0.0-lp150.7.14.1 libvirt-daemon-qemu-4.0.0-lp150.7.14.1 libvirt-daemon-uml-4.0.0-lp150.7.14.1 libvirt-daemon-vbox-4.0.0-lp150.7.14.1 libvirt-debugsource-4.0.0-lp150.7.14.1 libvirt-devel-4.0.0-lp150.7.14.1 libvirt-doc-4.0.0-lp150.7.14.1 libvirt-libs-4.0.0-lp150.7.14.1 libvirt-libs-debuginfo-4.0.0-lp150.7.14.1 libvirt-lock-sanlock-4.0.0-lp150.7.14.1 libvirt-lock-sanlock-debuginfo-4.0.0-lp150.7.14.1 libvirt-nss-4.0.0-lp150.7.14.1 libvirt-nss-debuginfo-4.0.0-lp150.7.14.1 wireshark-plugin-libvirt-4.0.0-lp150.7.14.1 wireshark-plugin-libvirt-debuginfo-4.0.0-lp150.7.14.1 - openSUSE Leap 15.0 (x86_64): libvirt-client-32bit-debuginfo-4.0.0-lp150.7.14.1 libvirt-daemon-driver-libxl-4.0.0-lp150.7.14.1 libvirt-daemon-driver-libxl-debuginfo-4.0.0-lp150.7.14.1 libvirt-daemon-driver-storage-rbd-4.0.0-lp150.7.14.1 libvirt-daemon-driver-storage-rbd-debuginfo-4.0.0-lp150.7.14.1 libvirt-daemon-xen-4.0.0-lp150.7.14.1 libvirt-devel-32bit-4.0.0-lp150.7.14.1 References: https://www.suse.com/security/cve/CVE-2018-12126.html https://www.suse.com/security/cve/CVE-2018-12127.html https://www.suse.com/security/cve/CVE-2018-12130.html https://www.suse.com/security/cve/CVE-2019-11091.html https://bugzilla.suse.com/1111331 https://bugzilla.suse.com/1135273 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1500-1: moderate: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 03 Jun '19

03 Jun '19

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1500-1 Rating: moderate References: #1122293 #1122299 #1132728 #1132729 #1132732 #1134297 Cross-References: CVE-2018-11212 CVE-2019-2422 CVE-2019-2426 CVE-2019-2602 CVE-2019-2684 CVE-2019-2698 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for java-1_7_0-openjdk fixes the following issues: Update to 2.6.18 - OpenJDK 7u221 (April 2019 CPU) Security issues fixed: - CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component: Libraries) (bsc#1132728). - CVE-2019-2684: Fixed flaw inside the RMI registry implementation (bsc#1132732). - CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729). - CVE-2019-2422: Fixed memory disclosure in FileChannelImpl (bsc#1122293). - CVE-2018-11212: Fixed a Divide By Zero in alloc_sarray function in jmemmgr.c (bsc#1122299). - CVE-2019-2426: Improve web server connections (bsc#1134297). Bug fixes: - Please check the package Changelog for detailed information. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1500=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_7_0-openjdk-1.7.0.221-57.1 java-1_7_0-openjdk-accessibility-1.7.0.221-57.1 java-1_7_0-openjdk-bootstrap-1.7.0.221-57.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.221-57.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.221-57.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.221-57.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.221-57.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.221-57.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.221-57.1 java-1_7_0-openjdk-debuginfo-1.7.0.221-57.1 java-1_7_0-openjdk-debugsource-1.7.0.221-57.1 java-1_7_0-openjdk-demo-1.7.0.221-57.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.221-57.1 java-1_7_0-openjdk-devel-1.7.0.221-57.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.221-57.1 java-1_7_0-openjdk-headless-1.7.0.221-57.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.221-57.1 java-1_7_0-openjdk-src-1.7.0.221-57.1 - openSUSE Leap 42.3 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.221-57.1 References: https://www.suse.com/security/cve/CVE-2018-11212.html https://www.suse.com/security/cve/CVE-2019-2422.html https://www.suse.com/security/cve/CVE-2019-2426.html https://www.suse.com/security/cve/CVE-2019-2602.html https://www.suse.com/security/cve/CVE-2019-2684.html https://www.suse.com/security/cve/CVE-2019-2698.html https://bugzilla.suse.com/1122293 https://bugzilla.suse.com/1122299 https://bugzilla.suse.com/1132728 https://bugzilla.suse.com/1132729 https://bugzilla.suse.com/1132732 https://bugzilla.suse.com/1134297 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0