June 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:1671-1: important: Security update for dbus-1
by opensuse-security＠opensuse.org 30 Jun '19

30 Jun '19

openSUSE Security Update: Security update for dbus-1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1671-1 Rating: important References: #1137832 Cross-References: CVE-2019-12749 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dbus-1 fixes the following issue: Security issue fixed: - CVE-2019-12749: Fixed an implementation flaw in DBUS_COOKIE_SHA1 which could have allowed local attackers to bypass authentication (bsc#1137832). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1671=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): dbus-1-1.12.2-lp150.2.4.2 dbus-1-debuginfo-1.12.2-lp150.2.4.2 dbus-1-debugsource-1.12.2-lp150.2.4.2 dbus-1-devel-1.12.2-lp150.2.4.2 dbus-1-x11-1.12.2-lp150.2.4.2 dbus-1-x11-debuginfo-1.12.2-lp150.2.4.2 dbus-1-x11-debugsource-1.12.2-lp150.2.4.2 libdbus-1-3-1.12.2-lp150.2.4.2 libdbus-1-3-debuginfo-1.12.2-lp150.2.4.2 - openSUSE Leap 15.0 (x86_64): dbus-1-32bit-debuginfo-1.12.2-lp150.2.4.2 dbus-1-devel-32bit-1.12.2-lp150.2.4.2 libdbus-1-3-32bit-1.12.2-lp150.2.4.2 libdbus-1-3-32bit-debuginfo-1.12.2-lp150.2.4.2 - openSUSE Leap 15.0 (noarch): dbus-1-devel-doc-1.12.2-lp150.2.4.2 References: https://www.suse.com/security/cve/CVE-2019-12749.html https://bugzilla.suse.com/1137832 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1672-1: important: Security update for libvirt
by opensuse-security＠opensuse.org 30 Jun '19

30 Jun '19

openSUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1672-1 Rating: important References: #1136109 #1138301 #1138302 #1138303 Cross-References: CVE-2019-10161 CVE-2019-10166 CVE-2019-10167 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for libvirt fixes the following issues: Security issues fixed: - CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd (bsc#1138301). - CVE-2019-10166: Fixed an issue with virDomainManagedSaveDefineXML which could have been used to alter the domain's config used for managedsave or execute arbitrary emulator binaries (bsc#1138302). - CVE-2019-10167: Fixed an issue with virConnectGetDomainCapabilities API which could have been used to execute arbitrary emulators (bsc#1138303). Other issue addressed: - spec: add systemd-container dependency to qemu and lxc drivers (bsc#1136109). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1672=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libvirt-4.0.0-lp150.7.18.2 libvirt-admin-4.0.0-lp150.7.18.2 libvirt-admin-debuginfo-4.0.0-lp150.7.18.2 libvirt-client-4.0.0-lp150.7.18.2 libvirt-client-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-4.0.0-lp150.7.18.2 libvirt-daemon-config-network-4.0.0-lp150.7.18.2 libvirt-daemon-config-nwfilter-4.0.0-lp150.7.18.2 libvirt-daemon-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-interface-4.0.0-lp150.7.18.2 libvirt-daemon-driver-interface-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-lxc-4.0.0-lp150.7.18.2 libvirt-daemon-driver-lxc-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-network-4.0.0-lp150.7.18.2 libvirt-daemon-driver-network-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-nodedev-4.0.0-lp150.7.18.2 libvirt-daemon-driver-nodedev-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-nwfilter-4.0.0-lp150.7.18.2 libvirt-daemon-driver-nwfilter-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-qemu-4.0.0-lp150.7.18.2 libvirt-daemon-driver-qemu-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-secret-4.0.0-lp150.7.18.2 libvirt-daemon-driver-secret-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-core-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-core-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-disk-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-disk-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-iscsi-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-iscsi-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-logical-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-logical-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-mpath-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-mpath-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-scsi-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-scsi-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-uml-4.0.0-lp150.7.18.2 libvirt-daemon-driver-uml-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-vbox-4.0.0-lp150.7.18.2 libvirt-daemon-driver-vbox-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-hooks-4.0.0-lp150.7.18.2 libvirt-daemon-lxc-4.0.0-lp150.7.18.2 libvirt-daemon-qemu-4.0.0-lp150.7.18.2 libvirt-daemon-uml-4.0.0-lp150.7.18.2 libvirt-daemon-vbox-4.0.0-lp150.7.18.2 libvirt-debugsource-4.0.0-lp150.7.18.2 libvirt-devel-4.0.0-lp150.7.18.2 libvirt-doc-4.0.0-lp150.7.18.2 libvirt-libs-4.0.0-lp150.7.18.2 libvirt-libs-debuginfo-4.0.0-lp150.7.18.2 libvirt-lock-sanlock-4.0.0-lp150.7.18.2 libvirt-lock-sanlock-debuginfo-4.0.0-lp150.7.18.2 libvirt-nss-4.0.0-lp150.7.18.2 libvirt-nss-debuginfo-4.0.0-lp150.7.18.2 wireshark-plugin-libvirt-4.0.0-lp150.7.18.2 wireshark-plugin-libvirt-debuginfo-4.0.0-lp150.7.18.2 - openSUSE Leap 15.0 (x86_64): libvirt-client-32bit-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-libxl-4.0.0-lp150.7.18.2 libvirt-daemon-driver-libxl-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-rbd-4.0.0-lp150.7.18.2 libvirt-daemon-driver-storage-rbd-debuginfo-4.0.0-lp150.7.18.2 libvirt-daemon-xen-4.0.0-lp150.7.18.2 libvirt-devel-32bit-4.0.0-lp150.7.18.2 References: https://www.suse.com/security/cve/CVE-2019-10161.html https://www.suse.com/security/cve/CVE-2019-10166.html https://www.suse.com/security/cve/CVE-2019-10167.html https://bugzilla.suse.com/1136109 https://bugzilla.suse.com/1138301 https://bugzilla.suse.com/1138302 https://bugzilla.suse.com/1138303 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1673-1: moderate: Security update for tomcat
by opensuse-security＠opensuse.org 30 Jun '19

30 Jun '19

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1673-1 Rating: moderate References: #1111966 #1131055 #1136085 Cross-References: CVE-2019-0199 CVE-2019-0221 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for tomcat to version 9.0.20 fixes the following issues: Security issues fixed: - CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to streams with excessive numbers of SETTINGS frames (bsc#1131055). - CVE-2019-0221: Fixed a cross site scripting vulnerability with the SSI printenv command (bsc#1136085). Non-security issues fixed: - Increase maximum number of threads and open files for tomcat (bsc#1111966). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1673=1 Package List: - openSUSE Leap 15.0 (noarch): tomcat-9.0.20-lp150.2.19.1 tomcat-admin-webapps-9.0.20-lp150.2.19.1 tomcat-docs-webapp-9.0.20-lp150.2.19.1 tomcat-el-3_0-api-9.0.20-lp150.2.19.1 tomcat-embed-9.0.20-lp150.2.19.1 tomcat-javadoc-9.0.20-lp150.2.19.1 tomcat-jsp-2_3-api-9.0.20-lp150.2.19.1 tomcat-jsvc-9.0.20-lp150.2.19.1 tomcat-lib-9.0.20-lp150.2.19.1 tomcat-servlet-4_0-api-9.0.20-lp150.2.19.1 tomcat-webapps-9.0.20-lp150.2.19.1 References: https://www.suse.com/security/cve/CVE-2019-0199.html https://www.suse.com/security/cve/CVE-2019-0221.html https://bugzilla.suse.com/1111966 https://bugzilla.suse.com/1131055 https://bugzilla.suse.com/1136085 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1667-1: moderate: Recommended update for evince
by opensuse-security＠opensuse.org 30 Jun '19

30 Jun '19

openSUSE Security Update: Recommended update for evince ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1667-1 Rating: moderate References: #1122794 #1133037 Cross-References: CVE-2019-11459 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for evince provides the following fixes: Security issue fixed: - CVE-2019-11459: Fixed an improper error handling in which could have led to use of unitialized use of memory (bsc#1133037). Other issue addressed: - Removed Supplements from psdocument package, so that it isn't pulled in by default (bsc#1122794). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1667=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1667=1 Package List: - openSUSE Leap 15.1 (noarch): evince-lang-3.26.0+20180128.1bd86963-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): evince-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-debugsource-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-devel-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-comicsdocument-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-comicsdocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-djvudocument-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-djvudocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-dvidocument-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-dvidocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-pdfdocument-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-pdfdocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-psdocument-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-psdocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-tiffdocument-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-tiffdocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-xpsdocument-3.26.0+20180128.1bd86963-lp151.4.3.1 evince-plugin-xpsdocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 libevdocument3-4-3.26.0+20180128.1bd86963-lp151.4.3.1 libevdocument3-4-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 libevview3-3-3.26.0+20180128.1bd86963-lp151.4.3.1 libevview3-3-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 nautilus-evince-3.26.0+20180128.1bd86963-lp151.4.3.1 nautilus-evince-debuginfo-3.26.0+20180128.1bd86963-lp151.4.3.1 typelib-1_0-EvinceDocument-3_0-3.26.0+20180128.1bd86963-lp151.4.3.1 typelib-1_0-EvinceView-3_0-3.26.0+20180128.1bd86963-lp151.4.3.1 - openSUSE Leap 15.0 (x86_64): evince-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-debugsource-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-devel-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-comicsdocument-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-comicsdocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-djvudocument-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-djvudocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-dvidocument-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-dvidocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-pdfdocument-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-pdfdocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-psdocument-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-psdocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-tiffdocument-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-tiffdocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-xpsdocument-3.26.0+20180128.1bd86963-lp150.3.3.1 evince-plugin-xpsdocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 libevdocument3-4-3.26.0+20180128.1bd86963-lp150.3.3.1 libevdocument3-4-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 libevview3-3-3.26.0+20180128.1bd86963-lp150.3.3.1 libevview3-3-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 nautilus-evince-3.26.0+20180128.1bd86963-lp150.3.3.1 nautilus-evince-debuginfo-3.26.0+20180128.1bd86963-lp150.3.3.1 typelib-1_0-EvinceDocument-3_0-3.26.0+20180128.1bd86963-lp150.3.3.1 typelib-1_0-EvinceView-3_0-3.26.0+20180128.1bd86963-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): evince-lang-3.26.0+20180128.1bd86963-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-11459.html https://bugzilla.suse.com/1122794 https://bugzilla.suse.com/1133037 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1668-1: moderate: Security update for postgresql96
by opensuse-security＠opensuse.org 30 Jun '19

30 Jun '19

openSUSE Security Update: Security update for postgresql96 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1668-1 Rating: moderate References: #1134689 Cross-References: CVE-2019-10130 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql96 fixes the following issues: Security issue fixed: - CVE-2019-10130: Prevent row-level security policies from being bypassed via selectivity estimators (bsc#1134689). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1668=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): postgresql96-9.6.13-24.1 postgresql96-contrib-9.6.13-24.1 postgresql96-contrib-debuginfo-9.6.13-24.1 postgresql96-debuginfo-9.6.13-24.1 postgresql96-debugsource-9.6.13-24.1 postgresql96-devel-9.6.13-24.1 postgresql96-devel-debuginfo-9.6.13-24.1 postgresql96-libs-debugsource-9.6.13-24.1 postgresql96-plperl-9.6.13-24.1 postgresql96-plperl-debuginfo-9.6.13-24.1 postgresql96-plpython-9.6.13-24.1 postgresql96-plpython-debuginfo-9.6.13-24.1 postgresql96-pltcl-9.6.13-24.1 postgresql96-pltcl-debuginfo-9.6.13-24.1 postgresql96-server-9.6.13-24.1 postgresql96-server-debuginfo-9.6.13-24.1 postgresql96-test-9.6.13-24.1 - openSUSE Leap 42.3 (noarch): postgresql96-docs-9.6.13-24.1 References: https://www.suse.com/security/cve/CVE-2019-10130.html https://bugzilla.suse.com/1134689 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1669-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 30 Jun '19

30 Jun '19

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1669-1 Rating: moderate References: #1136021 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for wireshark to version 2.4.15 fixes the following issues: Security issue fixed: - Fixed a denial of service in the dissection engine (bsc#1136021). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1669=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1669=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libwireshark9-2.4.15-lp151.2.3.1 libwireshark9-debuginfo-2.4.15-lp151.2.3.1 libwiretap7-2.4.15-lp151.2.3.1 libwiretap7-debuginfo-2.4.15-lp151.2.3.1 libwscodecs1-2.4.15-lp151.2.3.1 libwscodecs1-debuginfo-2.4.15-lp151.2.3.1 libwsutil8-2.4.15-lp151.2.3.1 libwsutil8-debuginfo-2.4.15-lp151.2.3.1 wireshark-2.4.15-lp151.2.3.1 wireshark-debuginfo-2.4.15-lp151.2.3.1 wireshark-debugsource-2.4.15-lp151.2.3.1 wireshark-devel-2.4.15-lp151.2.3.1 wireshark-ui-qt-2.4.15-lp151.2.3.1 wireshark-ui-qt-debuginfo-2.4.15-lp151.2.3.1 - openSUSE Leap 15.0 (i586 x86_64): libwireshark9-2.4.15-lp150.2.29.1 libwireshark9-debuginfo-2.4.15-lp150.2.29.1 libwiretap7-2.4.15-lp150.2.29.1 libwiretap7-debuginfo-2.4.15-lp150.2.29.1 libwscodecs1-2.4.15-lp150.2.29.1 libwscodecs1-debuginfo-2.4.15-lp150.2.29.1 libwsutil8-2.4.15-lp150.2.29.1 libwsutil8-debuginfo-2.4.15-lp150.2.29.1 wireshark-2.4.15-lp150.2.29.1 wireshark-debuginfo-2.4.15-lp150.2.29.1 wireshark-debugsource-2.4.15-lp150.2.29.1 wireshark-devel-2.4.15-lp150.2.29.1 wireshark-ui-qt-2.4.15-lp150.2.29.1 wireshark-ui-qt-debuginfo-2.4.15-lp150.2.29.1 References: https://bugzilla.suse.com/1136021 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1666-1: important: Security update for chromium
by opensuse-security＠opensuse.org 28 Jun '19

28 Jun '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1666-1 Rating: important References: #1129059 #1133313 #1134218 #1137332 #1138287 Cross-References: CVE-2019-5787 CVE-2019-5788 CVE-2019-5789 CVE-2019-5790 CVE-2019-5791 CVE-2019-5792 CVE-2019-5793 CVE-2019-5794 CVE-2019-5795 CVE-2019-5796 CVE-2019-5797 CVE-2019-5798 CVE-2019-5799 CVE-2019-5800 CVE-2019-5801 CVE-2019-5802 CVE-2019-5803 CVE-2019-5804 CVE-2019-5805 CVE-2019-5806 CVE-2019-5807 CVE-2019-5808 CVE-2019-5809 CVE-2019-5810 CVE-2019-5811 CVE-2019-5812 CVE-2019-5813 CVE-2019-5814 CVE-2019-5815 CVE-2019-5816 CVE-2019-5817 CVE-2019-5818 CVE-2019-5819 CVE-2019-5820 CVE-2019-5821 CVE-2019-5822 CVE-2019-5823 CVE-2019-5824 CVE-2019-5827 CVE-2019-5828 CVE-2019-5829 CVE-2019-5830 CVE-2019-5831 CVE-2019-5832 CVE-2019-5833 CVE-2019-5834 CVE-2019-5835 CVE-2019-5836 CVE-2019-5837 CVE-2019-5838 CVE-2019-5839 CVE-2019-5840 CVE-2019-5842 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 53 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to 75.0.3770.90 (boo#1137332 boo#1138287): * CVE-2019-5842: Use-after-free in Blink. Also updated to 75.0.3770.80 boo#1137332: * CVE-2019-5828: Use after free in ServiceWorker * CVE-2019-5829: Use after free in Download Manager * CVE-2019-5830: Incorrectly credentialed requests in CORS * CVE-2019-5831: Incorrect map processing in V8 * CVE-2019-5832: Incorrect CORS handling in XHR * CVE-2019-5833: Inconsistent security UI placemen * CVE-2019-5835: Out of bounds read in Swiftshader * CVE-2019-5836: Heap buffer overflow in Angle * CVE-2019-5837: Cross-origin resources size disclosure in Appcache * CVE-2019-5838: Overly permissive tab access in Extensions * CVE-2019-5839: Incorrect handling of certain code points in Blink * CVE-2019-5840: Popup blocker bypass * Various fixes from internal audits, fuzzing and other initiatives * CVE-2019-5834: URL spoof in Omnibox on iOS Update to 74.0.3729.169: * Feature fixes update only Update to 74.0.3729.157: * Various security fixes from internal audits, fuzzing and other initiatives Includes security fixes from 74.0.3729.131 (boo#1134218): * CVE-2019-5827: Out-of-bounds access in SQLite * CVE-2019-5824: Parameter passing error in media player Update to 74.0.3729.108 boo#1133313: * CVE-2019-5805: Use after free in PDFium * CVE-2019-5806: Integer overflow in Angle * CVE-2019-5807: Memory corruption in V8 * CVE-2019-5808: Use after free in Blink * CVE-2019-5809: Use after free in Blink * CVE-2019-5810: User information disclosure in Autofill * CVE-2019-5811: CORS bypass in Blink * CVE-2019-5813: Out of bounds read in V8 * CVE-2019-5814: CORS bypass in Blink * CVE-2019-5815: Heap buffer overflow in Blink * CVE-2019-5818: Uninitialized value in media reader * CVE-2019-5819: Incorrect escaping in developer tools * CVE-2019-5820: Integer overflow in PDFium * CVE-2019-5821: Integer overflow in PDFium * CVE-2019-5822: CORS bypass in download manager * CVE-2019-5823: Forced navigation from service worker * CVE-2019-5812: URL spoof in Omnibox on iOS * CVE-2019-5816: Exploit persistence extension on Android * CVE-2019-5817: Heap buffer overflow in Angle on Windows Update to 73.0.3686.103: * Various feature fixes Update to 73.0.3683.86: * Just feature fixes around - Update conditions to use system harfbuzz on TW+ - Require java during build - Enable using pipewire when available - Rebase chromium-vaapi.patch to match up the Fedora one Update to 73.0.3683.75 boo#1129059: * CVE-2019-5787: Use after free in Canvas. * CVE-2019-5788: Use after free in FileAPI. * CVE-2019-5789: Use after free in WebMIDI. * CVE-2019-5790: Heap buffer overflow in V8. * CVE-2019-5791: Type confusion in V8. * CVE-2019-5792: Integer overflow in PDFium. * CVE-2019-5793: Excessive permissions for private API in Extensions. * CVE-2019-5794: Security UI spoofing. * CVE-2019-5795: Integer overflow in PDFium. * CVE-2019-5796: Race condition in Extensions. * CVE-2019-5797: Race condition in DOMStorage. * CVE-2019-5798: Out of bounds read in Skia. * CVE-2019-5799: CSP bypass with blob URL. * CVE-2019-5800: CSP bypass with blob URL. * CVE-2019-5801: Incorrect Omnibox display on iOS. * CVE-2019-5802: Security UI spoofing. * CVE-2019-5803: CSP bypass with Javascript URLs'. * CVE-2019-5804: Command line command injection on Windows. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1666=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1666=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1666=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1666=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1666=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-75.0.3770.90-217.1 chromedriver-debuginfo-75.0.3770.90-217.1 chromium-75.0.3770.90-217.1 chromium-debuginfo-75.0.3770.90-217.1 chromium-debugsource-75.0.3770.90-217.1 - openSUSE Leap 15.1 (x86_64): chromedriver-75.0.3770.90-lp151.2.9.3 chromedriver-debuginfo-75.0.3770.90-lp151.2.9.3 chromium-75.0.3770.90-lp151.2.9.3 chromium-debuginfo-75.0.3770.90-lp151.2.9.3 chromium-debugsource-75.0.3770.90-lp151.2.9.3 - openSUSE Leap 15.0 (x86_64): chromedriver-75.0.3770.90-lp150.218.4 chromedriver-debuginfo-75.0.3770.90-lp150.218.4 chromium-75.0.3770.90-lp150.218.4 chromium-debuginfo-75.0.3770.90-lp150.218.4 chromium-debugsource-75.0.3770.90-lp150.218.4 - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-75.0.3770.90-bp150.213.3 chromedriver-debuginfo-75.0.3770.90-bp150.213.3 chromium-75.0.3770.90-bp150.213.3 chromium-debuginfo-75.0.3770.90-bp150.213.3 chromium-debugsource-75.0.3770.90-bp150.213.3 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-75.0.3770.90-2.1 chromedriver-debuginfo-75.0.3770.90-2.1 chromium-75.0.3770.90-2.1 chromium-debuginfo-75.0.3770.90-2.1 chromium-debugsource-75.0.3770.90-2.1 References: https://www.suse.com/security/cve/CVE-2019-5787.html https://www.suse.com/security/cve/CVE-2019-5788.html https://www.suse.com/security/cve/CVE-2019-5789.html https://www.suse.com/security/cve/CVE-2019-5790.html https://www.suse.com/security/cve/CVE-2019-5791.html https://www.suse.com/security/cve/CVE-2019-5792.html https://www.suse.com/security/cve/CVE-2019-5793.html https://www.suse.com/security/cve/CVE-2019-5794.html https://www.suse.com/security/cve/CVE-2019-5795.html https://www.suse.com/security/cve/CVE-2019-5796.html https://www.suse.com/security/cve/CVE-2019-5797.html https://www.suse.com/security/cve/CVE-2019-5798.html https://www.suse.com/security/cve/CVE-2019-5799.html https://www.suse.com/security/cve/CVE-2019-5800.html https://www.suse.com/security/cve/CVE-2019-5801.html https://www.suse.com/security/cve/CVE-2019-5802.html https://www.suse.com/security/cve/CVE-2019-5803.html https://www.suse.com/security/cve/CVE-2019-5804.html https://www.suse.com/security/cve/CVE-2019-5805.html https://www.suse.com/security/cve/CVE-2019-5806.html https://www.suse.com/security/cve/CVE-2019-5807.html https://www.suse.com/security/cve/CVE-2019-5808.html https://www.suse.com/security/cve/CVE-2019-5809.html https://www.suse.com/security/cve/CVE-2019-5810.html https://www.suse.com/security/cve/CVE-2019-5811.html https://www.suse.com/security/cve/CVE-2019-5812.html https://www.suse.com/security/cve/CVE-2019-5813.html https://www.suse.com/security/cve/CVE-2019-5814.html https://www.suse.com/security/cve/CVE-2019-5815.html https://www.suse.com/security/cve/CVE-2019-5816.html https://www.suse.com/security/cve/CVE-2019-5817.html https://www.suse.com/security/cve/CVE-2019-5818.html https://www.suse.com/security/cve/CVE-2019-5819.html https://www.suse.com/security/cve/CVE-2019-5820.html https://www.suse.com/security/cve/CVE-2019-5821.html https://www.suse.com/security/cve/CVE-2019-5822.html https://www.suse.com/security/cve/CVE-2019-5823.html https://www.suse.com/security/cve/CVE-2019-5824.html https://www.suse.com/security/cve/CVE-2019-5827.html https://www.suse.com/security/cve/CVE-2019-5828.html https://www.suse.com/security/cve/CVE-2019-5829.html https://www.suse.com/security/cve/CVE-2019-5830.html https://www.suse.com/security/cve/CVE-2019-5831.html https://www.suse.com/security/cve/CVE-2019-5832.html https://www.suse.com/security/cve/CVE-2019-5833.html https://www.suse.com/security/cve/CVE-2019-5834.html https://www.suse.com/security/cve/CVE-2019-5835.html https://www.suse.com/security/cve/CVE-2019-5836.html https://www.suse.com/security/cve/CVE-2019-5837.html https://www.suse.com/security/cve/CVE-2019-5838.html https://www.suse.com/security/cve/CVE-2019-5839.html https://www.suse.com/security/cve/CVE-2019-5840.html https://www.suse.com/security/cve/CVE-2019-5842.html https://bugzilla.suse.com/1129059 https://bugzilla.suse.com/1133313 https://bugzilla.suse.com/1134218 https://bugzilla.suse.com/1137332 https://bugzilla.suse.com/1138287 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1666-1: important: Security update for chromium
by opensuse-security＠opensuse.org 28 Jun '19

28 Jun '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1666-1 Rating: important References: #1129059 #1133313 #1134218 #1137332 #1138287 Cross-References: CVE-2019-5787 CVE-2019-5788 CVE-2019-5789 CVE-2019-5790 CVE-2019-5791 CVE-2019-5792 CVE-2019-5793 CVE-2019-5794 CVE-2019-5795 CVE-2019-5796 CVE-2019-5797 CVE-2019-5798 CVE-2019-5799 CVE-2019-5800 CVE-2019-5801 CVE-2019-5802 CVE-2019-5803 CVE-2019-5804 CVE-2019-5805 CVE-2019-5806 CVE-2019-5807 CVE-2019-5808 CVE-2019-5809 CVE-2019-5810 CVE-2019-5811 CVE-2019-5812 CVE-2019-5813 CVE-2019-5814 CVE-2019-5815 CVE-2019-5816 CVE-2019-5817 CVE-2019-5818 CVE-2019-5819 CVE-2019-5820 CVE-2019-5821 CVE-2019-5822 CVE-2019-5823 CVE-2019-5824 CVE-2019-5827 CVE-2019-5828 CVE-2019-5829 CVE-2019-5830 CVE-2019-5831 CVE-2019-5832 CVE-2019-5833 CVE-2019-5834 CVE-2019-5835 CVE-2019-5836 CVE-2019-5837 CVE-2019-5838 CVE-2019-5839 CVE-2019-5840 CVE-2019-5842 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 53 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to 75.0.3770.90 (boo#1137332 boo#1138287): * CVE-2019-5842: Use-after-free in Blink. Also updated to 75.0.3770.80 boo#1137332: * CVE-2019-5828: Use after free in ServiceWorker * CVE-2019-5829: Use after free in Download Manager * CVE-2019-5830: Incorrectly credentialed requests in CORS * CVE-2019-5831: Incorrect map processing in V8 * CVE-2019-5832: Incorrect CORS handling in XHR * CVE-2019-5833: Inconsistent security UI placemen * CVE-2019-5835: Out of bounds read in Swiftshader * CVE-2019-5836: Heap buffer overflow in Angle * CVE-2019-5837: Cross-origin resources size disclosure in Appcache * CVE-2019-5838: Overly permissive tab access in Extensions * CVE-2019-5839: Incorrect handling of certain code points in Blink * CVE-2019-5840: Popup blocker bypass * Various fixes from internal audits, fuzzing and other initiatives * CVE-2019-5834: URL spoof in Omnibox on iOS Update to 74.0.3729.169: * Feature fixes update only Update to 74.0.3729.157: * Various security fixes from internal audits, fuzzing and other initiatives Includes security fixes from 74.0.3729.131 (boo#1134218): * CVE-2019-5827: Out-of-bounds access in SQLite * CVE-2019-5824: Parameter passing error in media player Update to 74.0.3729.108 boo#1133313: * CVE-2019-5805: Use after free in PDFium * CVE-2019-5806: Integer overflow in Angle * CVE-2019-5807: Memory corruption in V8 * CVE-2019-5808: Use after free in Blink * CVE-2019-5809: Use after free in Blink * CVE-2019-5810: User information disclosure in Autofill * CVE-2019-5811: CORS bypass in Blink * CVE-2019-5813: Out of bounds read in V8 * CVE-2019-5814: CORS bypass in Blink * CVE-2019-5815: Heap buffer overflow in Blink * CVE-2019-5818: Uninitialized value in media reader * CVE-2019-5819: Incorrect escaping in developer tools * CVE-2019-5820: Integer overflow in PDFium * CVE-2019-5821: Integer overflow in PDFium * CVE-2019-5822: CORS bypass in download manager * CVE-2019-5823: Forced navigation from service worker * CVE-2019-5812: URL spoof in Omnibox on iOS * CVE-2019-5816: Exploit persistence extension on Android * CVE-2019-5817: Heap buffer overflow in Angle on Windows Update to 73.0.3686.103: * Various feature fixes Update to 73.0.3683.86: * Just feature fixes around - Update conditions to use system harfbuzz on TW+ - Require java during build - Enable using pipewire when available - Rebase chromium-vaapi.patch to match up the Fedora one Update to 73.0.3683.75 boo#1129059: * CVE-2019-5787: Use after free in Canvas. * CVE-2019-5788: Use after free in FileAPI. * CVE-2019-5789: Use after free in WebMIDI. * CVE-2019-5790: Heap buffer overflow in V8. * CVE-2019-5791: Type confusion in V8. * CVE-2019-5792: Integer overflow in PDFium. * CVE-2019-5793: Excessive permissions for private API in Extensions. * CVE-2019-5794: Security UI spoofing. * CVE-2019-5795: Integer overflow in PDFium. * CVE-2019-5796: Race condition in Extensions. * CVE-2019-5797: Race condition in DOMStorage. * CVE-2019-5798: Out of bounds read in Skia. * CVE-2019-5799: CSP bypass with blob URL. * CVE-2019-5800: CSP bypass with blob URL. * CVE-2019-5801: Incorrect Omnibox display on iOS. * CVE-2019-5802: Security UI spoofing. * CVE-2019-5803: CSP bypass with Javascript URLs'. * CVE-2019-5804: Command line command injection on Windows. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1666=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1666=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1666=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1666=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-75.0.3770.90-217.1 chromedriver-debuginfo-75.0.3770.90-217.1 chromium-75.0.3770.90-217.1 chromium-debuginfo-75.0.3770.90-217.1 chromium-debugsource-75.0.3770.90-217.1 - openSUSE Leap 15.1 (x86_64): chromedriver-75.0.3770.90-lp151.2.9.3 chromedriver-debuginfo-75.0.3770.90-lp151.2.9.3 chromium-75.0.3770.90-lp151.2.9.3 chromium-debuginfo-75.0.3770.90-lp151.2.9.3 chromium-debugsource-75.0.3770.90-lp151.2.9.3 - openSUSE Leap 15.0 (x86_64): chromedriver-75.0.3770.90-lp150.218.4 chromedriver-debuginfo-75.0.3770.90-lp150.218.4 chromium-75.0.3770.90-lp150.218.4 chromium-debuginfo-75.0.3770.90-lp150.218.4 chromium-debugsource-75.0.3770.90-lp150.218.4 - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-75.0.3770.90-bp150.213.3 chromedriver-debuginfo-75.0.3770.90-bp150.213.3 chromium-75.0.3770.90-bp150.213.3 chromium-debuginfo-75.0.3770.90-bp150.213.3 chromium-debugsource-75.0.3770.90-bp150.213.3 References: https://www.suse.com/security/cve/CVE-2019-5787.html https://www.suse.com/security/cve/CVE-2019-5788.html https://www.suse.com/security/cve/CVE-2019-5789.html https://www.suse.com/security/cve/CVE-2019-5790.html https://www.suse.com/security/cve/CVE-2019-5791.html https://www.suse.com/security/cve/CVE-2019-5792.html https://www.suse.com/security/cve/CVE-2019-5793.html https://www.suse.com/security/cve/CVE-2019-5794.html https://www.suse.com/security/cve/CVE-2019-5795.html https://www.suse.com/security/cve/CVE-2019-5796.html https://www.suse.com/security/cve/CVE-2019-5797.html https://www.suse.com/security/cve/CVE-2019-5798.html https://www.suse.com/security/cve/CVE-2019-5799.html https://www.suse.com/security/cve/CVE-2019-5800.html https://www.suse.com/security/cve/CVE-2019-5801.html https://www.suse.com/security/cve/CVE-2019-5802.html https://www.suse.com/security/cve/CVE-2019-5803.html https://www.suse.com/security/cve/CVE-2019-5804.html https://www.suse.com/security/cve/CVE-2019-5805.html https://www.suse.com/security/cve/CVE-2019-5806.html https://www.suse.com/security/cve/CVE-2019-5807.html https://www.suse.com/security/cve/CVE-2019-5808.html https://www.suse.com/security/cve/CVE-2019-5809.html https://www.suse.com/security/cve/CVE-2019-5810.html https://www.suse.com/security/cve/CVE-2019-5811.html https://www.suse.com/security/cve/CVE-2019-5812.html https://www.suse.com/security/cve/CVE-2019-5813.html https://www.suse.com/security/cve/CVE-2019-5814.html https://www.suse.com/security/cve/CVE-2019-5815.html https://www.suse.com/security/cve/CVE-2019-5816.html https://www.suse.com/security/cve/CVE-2019-5817.html https://www.suse.com/security/cve/CVE-2019-5818.html https://www.suse.com/security/cve/CVE-2019-5819.html https://www.suse.com/security/cve/CVE-2019-5820.html https://www.suse.com/security/cve/CVE-2019-5821.html https://www.suse.com/security/cve/CVE-2019-5822.html https://www.suse.com/security/cve/CVE-2019-5823.html https://www.suse.com/security/cve/CVE-2019-5824.html https://www.suse.com/security/cve/CVE-2019-5827.html https://www.suse.com/security/cve/CVE-2019-5828.html https://www.suse.com/security/cve/CVE-2019-5829.html https://www.suse.com/security/cve/CVE-2019-5830.html https://www.suse.com/security/cve/CVE-2019-5831.html https://www.suse.com/security/cve/CVE-2019-5832.html https://www.suse.com/security/cve/CVE-2019-5833.html https://www.suse.com/security/cve/CVE-2019-5834.html https://www.suse.com/security/cve/CVE-2019-5835.html https://www.suse.com/security/cve/CVE-2019-5836.html https://www.suse.com/security/cve/CVE-2019-5837.html https://www.suse.com/security/cve/CVE-2019-5838.html https://www.suse.com/security/cve/CVE-2019-5839.html https://www.suse.com/security/cve/CVE-2019-5840.html https://www.suse.com/security/cve/CVE-2019-5842.html https://bugzilla.suse.com/1129059 https://bugzilla.suse.com/1133313 https://bugzilla.suse.com/1134218 https://bugzilla.suse.com/1137332 https://bugzilla.suse.com/1138287 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1664-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 28 Jun '19

28 Jun '19

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1664-1 Rating: important References: #1130694 #1133267 #1135824 #1137595 #1138872 Cross-References: CVE-2018-18511 CVE-2019-11691 CVE-2019-11692 CVE-2019-11693 CVE-2019-11694 CVE-2019-11698 CVE-2019-11703 CVE-2019-11704 CVE-2019-11705 CVE-2019-11706 CVE-2019-11707 CVE-2019-11708 CVE-2019-5798 CVE-2019-7317 CVE-2019-9797 CVE-2019-9800 CVE-2019-9815 CVE-2019-9816 CVE-2019-9817 CVE-2019-9818 CVE-2019-9819 CVE-2019-9820 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 22 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: Mozilla Thunderbird was updated to 60.7.2 / MFSA 2019-20 (boo#1138872): * CVE-2019-11707: Type confusion in Array.pop * CVE-2019-11708: sandbox escape using Prompt:Open Mozilla Thunderbird was updated to 60.7.1 / MFSA 2019-17 (boo#1137595): * CVE-2019-11703: Heap buffer overflow in icalparser.c * CVE-2019-11704: Heap buffer overflow in icalvalue.c * CVE-2019-11705: Stack buffer overflow in icalrecur.c * CVE-2019-11706: Type confusion in icalproperty.c Also fixed: No prompt for smartcard PIN when S/MIME signing is used Mozilla Thunderbird was updated to 60.7.0 / MFSA 2019-15 (boo#1135824): * Attachment pane of Write window no longer focussed when attaching files using a keyboard shortcut * CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS * CVE-2019-9816: Type confusion with object groups and UnboxedObjects * CVE-2019-9817: Stealing of cross-domain images using canvas * CVE-2019-9818 (Windows only): Use-after-free in crash generation server * CVE-2019-9819: Compartment mismatch with fetch API * CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell * CVE-2019-11691: Use-after-free in XMLHttpRequest * CVE-2019-11692: Use-after-free removing listeners in the event listener manager * CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux * CVE-2019-7317: Use-after-free in png_image_free of libpng library * CVE-2019-9797: Cross-origin theft of images with createImageBitmap * CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext * CVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox * CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks * CVE-2019-5798: Out-of-bounds read in Skia * CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 - Disable building with LTO (boo#1133267). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1664=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-60.7.2-85.1 MozillaThunderbird-buildsymbols-60.7.2-85.1 MozillaThunderbird-translations-common-60.7.2-85.1 MozillaThunderbird-translations-other-60.7.2-85.1 References: https://www.suse.com/security/cve/CVE-2018-18511.html https://www.suse.com/security/cve/CVE-2019-11691.html https://www.suse.com/security/cve/CVE-2019-11692.html https://www.suse.com/security/cve/CVE-2019-11693.html https://www.suse.com/security/cve/CVE-2019-11694.html https://www.suse.com/security/cve/CVE-2019-11698.html https://www.suse.com/security/cve/CVE-2019-11703.html https://www.suse.com/security/cve/CVE-2019-11704.html https://www.suse.com/security/cve/CVE-2019-11705.html https://www.suse.com/security/cve/CVE-2019-11706.html https://www.suse.com/security/cve/CVE-2019-11707.html https://www.suse.com/security/cve/CVE-2019-11708.html https://www.suse.com/security/cve/CVE-2019-5798.html https://www.suse.com/security/cve/CVE-2019-7317.html https://www.suse.com/security/cve/CVE-2019-9797.html https://www.suse.com/security/cve/CVE-2019-9800.html https://www.suse.com/security/cve/CVE-2019-9815.html https://www.suse.com/security/cve/CVE-2019-9816.html https://www.suse.com/security/cve/CVE-2019-9817.html https://www.suse.com/security/cve/CVE-2019-9818.html https://www.suse.com/security/cve/CVE-2019-9819.html https://www.suse.com/security/cve/CVE-2019-9820.html https://bugzilla.suse.com/1130694 https://bugzilla.suse.com/1133267 https://bugzilla.suse.com/1135824 https://bugzilla.suse.com/1137595 https://bugzilla.suse.com/1138872 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1658-1: moderate: Security update for libmediainfo
by opensuse-security＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Security Update: Security update for libmediainfo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1658-1 Rating: moderate References: #1133156 #1133157 Cross-References: CVE-2019-11372 CVE-2019-11373 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libmediainfo fixes the following issues: * CVE-2019-11373: Fixed out-of-bounds read in function File__Analyze:Get_L8 (boo#1133156) * CVE-2019-11372: Fixed out-of-bounds read in function MediaInfoLib:File__Tags_Helper:Synched_Test (boo#1133157) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1658=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libmediainfo-devel-18.03-bp150.3.6.1 libmediainfo0-18.03-bp150.3.6.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libmediainfo0-64bit-18.03-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-11372.html https://www.suse.com/security/cve/CVE-2019-11373.html https://bugzilla.suse.com/1133156 https://bugzilla.suse.com/1133157 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1638-1: important: Security update for gstreamer-0_10-plugins-base
by opensuse-security＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Security Update: Security update for gstreamer-0_10-plugins-base ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1638-1 Rating: important References: #1133375 Cross-References: CVE-2019-9928 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gstreamer-0_10-plugins-base fixes the following issues: Security issue fixed: - CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1638=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gstreamer-0_10-plugin-gnomevfs-0.10.36-18.3.1 gstreamer-0_10-plugin-gnomevfs-debuginfo-0.10.36-18.3.1 gstreamer-0_10-plugins-base-0.10.36-18.3.1 gstreamer-0_10-plugins-base-debuginfo-0.10.36-18.3.1 gstreamer-0_10-plugins-base-debugsource-0.10.36-18.3.1 gstreamer-0_10-plugins-base-devel-0.10.36-18.3.1 gstreamer-0_10-plugins-base-doc-0.10.36-18.3.1 libgstapp-0_10-0-0.10.36-18.3.1 libgstapp-0_10-0-debuginfo-0.10.36-18.3.1 libgstinterfaces-0_10-0-0.10.36-18.3.1 libgstinterfaces-0_10-0-debuginfo-0.10.36-18.3.1 typelib-1_0-GstApp-0_10-0.10.36-18.3.1 typelib-1_0-GstInterfaces-0_10-0.10.36-18.3.1 - openSUSE Leap 42.3 (noarch): gstreamer-0_10-plugins-base-lang-0.10.36-18.3.1 - openSUSE Leap 42.3 (x86_64): gstreamer-0_10-plugins-base-32bit-0.10.36-18.3.1 gstreamer-0_10-plugins-base-debuginfo-32bit-0.10.36-18.3.1 libgstapp-0_10-0-32bit-0.10.36-18.3.1 libgstapp-0_10-0-debuginfo-32bit-0.10.36-18.3.1 libgstinterfaces-0_10-0-32bit-0.10.36-18.3.1 libgstinterfaces-0_10-0-debuginfo-32bit-0.10.36-18.3.1 References: https://www.suse.com/security/cve/CVE-2019-9928.html https://bugzilla.suse.com/1133375 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1632-1: moderate: Security update for SDL2
by opensuse-security＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Security Update: Security update for SDL2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1632-1 Rating: moderate References: #1124825 #1134135 Cross-References: CVE-2019-7637 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for SDL2 fixes the following issues: - Remove the fix for CVE-2019-7637, the modification of function SDL_CalculatePitch is only suited for SDL not SDL2, and breaks SDL2 software. (bsc#1134135) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1632=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): SDL2-debugsource-2.0.8-lp150.2.6.1 libSDL2-2_0-0-2.0.8-lp150.2.6.1 libSDL2-2_0-0-debuginfo-2.0.8-lp150.2.6.1 libSDL2-devel-2.0.8-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libSDL2-2_0-0-32bit-2.0.8-lp150.2.6.1 libSDL2-2_0-0-32bit-debuginfo-2.0.8-lp150.2.6.1 libSDL2-devel-32bit-2.0.8-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-7637.html https://bugzilla.suse.com/1124825 https://bugzilla.suse.com/1134135 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1637-1: moderate: Security update for compat-openssl098
by opensuse-security＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Security Update: Security update for compat-openssl098 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1637-1 Rating: moderate References: #1117951 #1127080 #1131291 Cross-References: CVE-2019-1559 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for compat-openssl098 fixes the following issues: - CVE-2019-1559: Fix 0-byte record padding oracle via SSL_shutdown (bsc#1127080) - Reject invalid EC point coordinates (bsc#1131291) - Fixed "The 9 Lives of Bleichenbacher's CAT: Cache ATtacks on TLS Implementations" (bsc#1117951) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1637=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): compat-openssl098-debugsource-0.9.8j-30.1 libopenssl0_9_8-0.9.8j-30.1 libopenssl0_9_8-debuginfo-0.9.8j-30.1 - openSUSE Leap 42.3 (x86_64): libopenssl0_9_8-32bit-0.9.8j-30.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-30.1 References: https://www.suse.com/security/cve/CVE-2019-1559.html https://bugzilla.suse.com/1117951 https://bugzilla.suse.com/1127080 https://bugzilla.suse.com/1131291 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1635-1: moderate: Security update for ansible
by opensuse-security＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Security Update: Security update for ansible ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1635-1 Rating: moderate References: #1109957 #1112959 #1118896 #1126503 Cross-References: CVE-2018-16837 CVE-2018-16859 CVE-2018-16876 CVE-2019-3828 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for ansible fixes the following issues: Ansible was updated to version 2.8.1: Full changelog is at /usr/share/doc/packages/ansible/changelogs/ - Bugfixes - ACI - DO not encode query_string - ACI modules - Fix non-signature authentication - Add missing directory provided via ``--playbook-dir`` to adjacent collection loading - Fix "Interface not found" errors when using eos_l2_interface with nonexistant interfaces configured - Fix cannot get credential when `source_auth` set to `credential_file`. - Fix netconf_config backup string issue - Fix privilege escalation support for the docker connection plugin when credentials need to be supplied (e.g. sudo with password). - Fix vyos cli prompt inspection - Fixed loading namespaced documentation fragments from collections. - Fixing bug came up after running cnos_vrf module against coverity. - Properly handle data importer failures on PVC creation, instead of timing out. - To fix the ios static route TC failure in CI - To fix the nios member module params - To fix the nios_zone module idempotency failure - add terminal initial prompt for initial connection - allow include_role to work with ansible command - allow python_requirements_facts to report on dependencies containing dashes - asa_config fix - azure_rm_roledefinition - fix a small error in build scope. - azure_rm_virtualnetworkpeering - fix cross subscriptions virtual network peering. - cgroup_perf_recap - When not using file_per_task, make sure we don't prematurely close the perf files - display underlying error when reporting an invalid ``tasks:`` block. - dnf - fix wildcard matching for state: absent - docker connection plugin - accept version ``dev`` as 'newest version' and print warning. - docker_container - ``oom_killer`` and ``oom_score_adj`` options are available since docker-py 1.8.0, not 2.0.0 as assumed by the version check. - docker_container - fix network creation when ``networks_cli_compatible`` is enabled. - docker_container - use docker API's ``restart`` instead of ``stop``/``start`` to restart a container. - docker_image - if ``build`` was not specified, the wrong default for ``build.rm`` is used. - docker_image - if ``nocache`` set to ``yes`` but not ``build.nocache``, the module failed. - docker_image - module failed when ``source: build`` was set but ``build.path`` options not specified. - docker_network module - fix idempotency when using ``aux_addresses`` in ``ipam_config``. - ec2_instance - make Name tag idempotent - eos: don't fail modules without become set, instead show message and continue - eos_config: check for session support when asked to 'diff_against: session' - eos_eapi: fix idempotency issues when vrf was unspecified. - fix bugs for ce - more info see - fix incorrect uses of to_native that should be to_text instead. - hcloud_volume - Fix idempotency when attaching a server to a volume. - ibm_storage - Added a check for null fields in ibm_storage utils module. - include_tasks - whitelist ``listen`` as a valid keyword - k8s - resource updates applied with force work correctly now - keep results subset also when not no_log. - meraki_switchport - improve reliability with native VLAN functionality. - netapp_e_iscsi_target - fix netapp_e_iscsi_target chap secret size and clearing functionality - netapp_e_volumes - fix workload profileId indexing when no previous workload tags exist on the storage array. - nxos_acl some platforms/versions raise when no ACLs are present - nxos_facts fix <https://github.com/ansible/ansible/pull/57009> - nxos_file_copy fix passwordless workflow - nxos_interface Fix admin_state check for n6k - nxos_snmp_traps fix group all for N35 platforms - nxos_snmp_user fix platform fixes for get_snmp_user - nxos_vlan mode idempotence bug - nxos_vlan vlan names containing regex ctl chars should be escaped - nxos_vtp_* modules fix n6k issues - openssl_certificate - fix private key passphrase handling for ``cryptography`` backend. - openssl_pkcs12 - fixes crash when private key has a passphrase and the module is run a second time. - os_stack - Apply tags conditionally so that the module does not throw up an error when using an older distro of openstacksdk - pass correct loading context to persistent connections other than local - pkg_mgr - Ansible 2.8.0 failing to install yum packages on Amazon Linux - postgresql - added initial SSL related tests - postgresql - added missing_required_libs, removed excess param mapping - postgresql - move connect_to_db and get_pg_version into module_utils/postgres.py (https://github.com/ansible/ansible/pull/55514) - postgresql_db - add note to the documentation about state dump and the incorrect rc (https://github.com/ansible/ansible/pull/57297) - postgresql_db - fix for postgresql_db fails if stderr contains output - postgresql_ping - fixed a typo in the module documentation - preserve actual ssh error when we cannot connect. - route53_facts - the module did not advertise check mode support, causing it not to be run in check mode. - sysctl: the module now also checks the output of STDERR to report if values are correctly set (https://github.com/ansible/ansible/pull/55695) - ufw - correctly check status when logging is off - uri - always return a value for status even during failure - urls - Handle redirects properly for IPv6 address by not splitting on ``:`` and rely on already parsed hostname and port values - vmware_vm_facts - fix the support with regular ESXi - vyos_interface fix <https://github.com/ansible/ansible/pull/57169> - we don't really need to template vars on definition as we do this on demand in templating. - win_acl - Fix qualifier parser when using UNC paths - - win_hostname - Fix non netbios compliant name handling - winrm - Fix issue when attempting to parse CLIXML on send input failure - xenserver_guest - fixed an issue where VM whould be powered off even though check mode is used if reconfiguration requires VM to be powered off. - xenserver_guest - proper error message is shown when maximum number of network interfaces is reached and multiple network interfaces are added at once. - yum - Fix false error message about autoremove not being supported - yum - fix failure when using ``update_cache`` standalone - yum - handle special "_none_" value for proxy in yum.conf and .repo files Update to version 2.8.0 Major changes: * Experimental support for Ansible Collections and content namespacing - Ansible content can now be packaged in a collection and addressed via namespaces. This allows for easier sharing, distribution, and installation of bundled modules/roles/plugins, and consistent rules for accessing specific content via namespaces. * Python interpreter discovery - The first time a Python module runs on a target, Ansible will attempt to discover the proper default Python interpreter to use for the target platform/version (instead of immediately defaulting to /usr/bin/python). You can override this behavior by setting ansible_python_interpreter or via config. (see https://github.com/ansible/ansible/pull/50163) * become - The deprecated CLI arguments for --sudo, --sudo-user, --ask-sudo-pass, -su, --su-user, and --ask-su-pass have been removed, in favor of the more generic --become, --become-user, --become-method, and --ask-become-pass. * become - become functionality has been migrated to a plugin architecture, to allow customization of become functionality and 3rd party become methods (https://github.com/ansible/ansible/pull/50991) - addresses CVE-2018-16859, CVE-2018-16876, CVE-2019-3828, CVE-2018-16837 For the full changelog see /usr/share/doc/packages/ansible/changelogs or online: https://github.com/ansible/ansible/blob/stable-2.8/changelogs/CHANGELOG-v2. 8.rst Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1635=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1635=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1635=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1635=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1635=1 Package List: - openSUSE Leap 42.3 (noarch): ansible-2.8.1-12.1 - openSUSE Leap 15.1 (noarch): ansible-2.8.1-lp151.2.3.1 - openSUSE Leap 15.0 (noarch): ansible-2.8.1-lp150.2.6.1 - openSUSE Backports SLE-15 (noarch): ansible-2.8.1-bp150.3.9.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): ansible-2.8.1-12.1 References: https://www.suse.com/security/cve/CVE-2018-16837.html https://www.suse.com/security/cve/CVE-2018-16859.html https://www.suse.com/security/cve/CVE-2018-16876.html https://www.suse.com/security/cve/CVE-2019-3828.html https://bugzilla.suse.com/1109957 https://bugzilla.suse.com/1112959 https://bugzilla.suse.com/1118896 https://bugzilla.suse.com/1126503 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1639-1: important: Security update for gstreamer-plugins-base
by opensuse-security＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Security Update: Security update for gstreamer-plugins-base ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1639-1 Rating: important References: #1133375 Cross-References: CVE-2019-9928 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gstreamer-plugins-base fixes the following issue: Security issue fixed: - CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1639=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gstreamer-plugins-base-1.8.3-8.3.1 gstreamer-plugins-base-debuginfo-1.8.3-8.3.1 gstreamer-plugins-base-debugsource-1.8.3-8.3.1 gstreamer-plugins-base-devel-1.8.3-8.3.1 gstreamer-plugins-base-doc-1.8.3-8.3.1 libgstallocators-1_0-0-1.8.3-8.3.1 libgstallocators-1_0-0-debuginfo-1.8.3-8.3.1 libgstapp-1_0-0-1.8.3-8.3.1 libgstapp-1_0-0-debuginfo-1.8.3-8.3.1 libgstaudio-1_0-0-1.8.3-8.3.1 libgstaudio-1_0-0-debuginfo-1.8.3-8.3.1 libgstfft-1_0-0-1.8.3-8.3.1 libgstfft-1_0-0-debuginfo-1.8.3-8.3.1 libgstpbutils-1_0-0-1.8.3-8.3.1 libgstpbutils-1_0-0-debuginfo-1.8.3-8.3.1 libgstriff-1_0-0-1.8.3-8.3.1 libgstriff-1_0-0-debuginfo-1.8.3-8.3.1 libgstrtp-1_0-0-1.8.3-8.3.1 libgstrtp-1_0-0-debuginfo-1.8.3-8.3.1 libgstrtsp-1_0-0-1.8.3-8.3.1 libgstrtsp-1_0-0-debuginfo-1.8.3-8.3.1 libgstsdp-1_0-0-1.8.3-8.3.1 libgstsdp-1_0-0-debuginfo-1.8.3-8.3.1 libgsttag-1_0-0-1.8.3-8.3.1 libgsttag-1_0-0-debuginfo-1.8.3-8.3.1 libgstvideo-1_0-0-1.8.3-8.3.1 libgstvideo-1_0-0-debuginfo-1.8.3-8.3.1 typelib-1_0-GstAllocators-1_0-1.8.3-8.3.1 typelib-1_0-GstApp-1_0-1.8.3-8.3.1 typelib-1_0-GstAudio-1_0-1.8.3-8.3.1 typelib-1_0-GstFft-1_0-1.8.3-8.3.1 typelib-1_0-GstPbutils-1_0-1.8.3-8.3.1 typelib-1_0-GstRtp-1_0-1.8.3-8.3.1 typelib-1_0-GstRtsp-1_0-1.8.3-8.3.1 typelib-1_0-GstSdp-1_0-1.8.3-8.3.1 typelib-1_0-GstTag-1_0-1.8.3-8.3.1 typelib-1_0-GstVideo-1_0-1.8.3-8.3.1 - openSUSE Leap 42.3 (x86_64): gstreamer-plugins-base-32bit-1.8.3-8.3.1 gstreamer-plugins-base-debuginfo-32bit-1.8.3-8.3.1 gstreamer-plugins-base-devel-32bit-1.8.3-8.3.1 libgstallocators-1_0-0-32bit-1.8.3-8.3.1 libgstallocators-1_0-0-debuginfo-32bit-1.8.3-8.3.1 libgstapp-1_0-0-32bit-1.8.3-8.3.1 libgstapp-1_0-0-debuginfo-32bit-1.8.3-8.3.1 libgstaudio-1_0-0-32bit-1.8.3-8.3.1 libgstaudio-1_0-0-debuginfo-32bit-1.8.3-8.3.1 libgstfft-1_0-0-32bit-1.8.3-8.3.1 libgstfft-1_0-0-debuginfo-32bit-1.8.3-8.3.1 libgstpbutils-1_0-0-32bit-1.8.3-8.3.1 libgstpbutils-1_0-0-debuginfo-32bit-1.8.3-8.3.1 libgstriff-1_0-0-32bit-1.8.3-8.3.1 libgstriff-1_0-0-debuginfo-32bit-1.8.3-8.3.1 libgstrtp-1_0-0-32bit-1.8.3-8.3.1 libgstrtp-1_0-0-debuginfo-32bit-1.8.3-8.3.1 libgstrtsp-1_0-0-32bit-1.8.3-8.3.1 libgstrtsp-1_0-0-debuginfo-32bit-1.8.3-8.3.1 libgstsdp-1_0-0-32bit-1.8.3-8.3.1 libgstsdp-1_0-0-debuginfo-32bit-1.8.3-8.3.1 libgsttag-1_0-0-32bit-1.8.3-8.3.1 libgsttag-1_0-0-debuginfo-32bit-1.8.3-8.3.1 libgstvideo-1_0-0-32bit-1.8.3-8.3.1 libgstvideo-1_0-0-debuginfo-32bit-1.8.3-8.3.1 - openSUSE Leap 42.3 (noarch): gstreamer-plugins-base-lang-1.8.3-8.3.1 References: https://www.suse.com/security/cve/CVE-2019-9928.html https://bugzilla.suse.com/1133375 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1635-1: moderate: Security update for ansible
by opensuse-security＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Security Update: Security update for ansible ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1635-1 Rating: moderate References: #1109957 #1112959 #1118896 #1126503 Cross-References: CVE-2018-16837 CVE-2018-16859 CVE-2018-16876 CVE-2019-3828 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for ansible fixes the following issues: Ansible was updated to version 2.8.1: Full changelog is at /usr/share/doc/packages/ansible/changelogs/ - Bugfixes - ACI - DO not encode query_string - ACI modules - Fix non-signature authentication - Add missing directory provided via ``--playbook-dir`` to adjacent collection loading - Fix "Interface not found" errors when using eos_l2_interface with nonexistant interfaces configured - Fix cannot get credential when `source_auth` set to `credential_file`. - Fix netconf_config backup string issue - Fix privilege escalation support for the docker connection plugin when credentials need to be supplied (e.g. sudo with password). - Fix vyos cli prompt inspection - Fixed loading namespaced documentation fragments from collections. - Fixing bug came up after running cnos_vrf module against coverity. - Properly handle data importer failures on PVC creation, instead of timing out. - To fix the ios static route TC failure in CI - To fix the nios member module params - To fix the nios_zone module idempotency failure - add terminal initial prompt for initial connection - allow include_role to work with ansible command - allow python_requirements_facts to report on dependencies containing dashes - asa_config fix - azure_rm_roledefinition - fix a small error in build scope. - azure_rm_virtualnetworkpeering - fix cross subscriptions virtual network peering. - cgroup_perf_recap - When not using file_per_task, make sure we don't prematurely close the perf files - display underlying error when reporting an invalid ``tasks:`` block. - dnf - fix wildcard matching for state: absent - docker connection plugin - accept version ``dev`` as 'newest version' and print warning. - docker_container - ``oom_killer`` and ``oom_score_adj`` options are available since docker-py 1.8.0, not 2.0.0 as assumed by the version check. - docker_container - fix network creation when ``networks_cli_compatible`` is enabled. - docker_container - use docker API's ``restart`` instead of ``stop``/``start`` to restart a container. - docker_image - if ``build`` was not specified, the wrong default for ``build.rm`` is used. - docker_image - if ``nocache`` set to ``yes`` but not ``build.nocache``, the module failed. - docker_image - module failed when ``source: build`` was set but ``build.path`` options not specified. - docker_network module - fix idempotency when using ``aux_addresses`` in ``ipam_config``. - ec2_instance - make Name tag idempotent - eos: don't fail modules without become set, instead show message and continue - eos_config: check for session support when asked to 'diff_against: session' - eos_eapi: fix idempotency issues when vrf was unspecified. - fix bugs for ce - more info see - fix incorrect uses of to_native that should be to_text instead. - hcloud_volume - Fix idempotency when attaching a server to a volume. - ibm_storage - Added a check for null fields in ibm_storage utils module. - include_tasks - whitelist ``listen`` as a valid keyword - k8s - resource updates applied with force work correctly now - keep results subset also when not no_log. - meraki_switchport - improve reliability with native VLAN functionality. - netapp_e_iscsi_target - fix netapp_e_iscsi_target chap secret size and clearing functionality - netapp_e_volumes - fix workload profileId indexing when no previous workload tags exist on the storage array. - nxos_acl some platforms/versions raise when no ACLs are present - nxos_facts fix <https://github.com/ansible/ansible/pull/57009> - nxos_file_copy fix passwordless workflow - nxos_interface Fix admin_state check for n6k - nxos_snmp_traps fix group all for N35 platforms - nxos_snmp_user fix platform fixes for get_snmp_user - nxos_vlan mode idempotence bug - nxos_vlan vlan names containing regex ctl chars should be escaped - nxos_vtp_* modules fix n6k issues - openssl_certificate - fix private key passphrase handling for ``cryptography`` backend. - openssl_pkcs12 - fixes crash when private key has a passphrase and the module is run a second time. - os_stack - Apply tags conditionally so that the module does not throw up an error when using an older distro of openstacksdk - pass correct loading context to persistent connections other than local - pkg_mgr - Ansible 2.8.0 failing to install yum packages on Amazon Linux - postgresql - added initial SSL related tests - postgresql - added missing_required_libs, removed excess param mapping - postgresql - move connect_to_db and get_pg_version into module_utils/postgres.py (https://github.com/ansible/ansible/pull/55514) - postgresql_db - add note to the documentation about state dump and the incorrect rc (https://github.com/ansible/ansible/pull/57297) - postgresql_db - fix for postgresql_db fails if stderr contains output - postgresql_ping - fixed a typo in the module documentation - preserve actual ssh error when we cannot connect. - route53_facts - the module did not advertise check mode support, causing it not to be run in check mode. - sysctl: the module now also checks the output of STDERR to report if values are correctly set (https://github.com/ansible/ansible/pull/55695) - ufw - correctly check status when logging is off - uri - always return a value for status even during failure - urls - Handle redirects properly for IPv6 address by not splitting on ``:`` and rely on already parsed hostname and port values - vmware_vm_facts - fix the support with regular ESXi - vyos_interface fix <https://github.com/ansible/ansible/pull/57169> - we don't really need to template vars on definition as we do this on demand in templating. - win_acl - Fix qualifier parser when using UNC paths - - win_hostname - Fix non netbios compliant name handling - winrm - Fix issue when attempting to parse CLIXML on send input failure - xenserver_guest - fixed an issue where VM whould be powered off even though check mode is used if reconfiguration requires VM to be powered off. - xenserver_guest - proper error message is shown when maximum number of network interfaces is reached and multiple network interfaces are added at once. - yum - Fix false error message about autoremove not being supported - yum - fix failure when using ``update_cache`` standalone - yum - handle special "_none_" value for proxy in yum.conf and .repo files Update to version 2.8.0 Major changes: * Experimental support for Ansible Collections and content namespacing - Ansible content can now be packaged in a collection and addressed via namespaces. This allows for easier sharing, distribution, and installation of bundled modules/roles/plugins, and consistent rules for accessing specific content via namespaces. * Python interpreter discovery - The first time a Python module runs on a target, Ansible will attempt to discover the proper default Python interpreter to use for the target platform/version (instead of immediately defaulting to /usr/bin/python). You can override this behavior by setting ansible_python_interpreter or via config. (see https://github.com/ansible/ansible/pull/50163) * become - The deprecated CLI arguments for --sudo, --sudo-user, --ask-sudo-pass, -su, --su-user, and --ask-su-pass have been removed, in favor of the more generic --become, --become-user, --become-method, and --ask-become-pass. * become - become functionality has been migrated to a plugin architecture, to allow customization of become functionality and 3rd party become methods (https://github.com/ansible/ansible/pull/50991) - addresses CVE-2018-16859, CVE-2018-16876, CVE-2019-3828, CVE-2018-16837 For the full changelog see /usr/share/doc/packages/ansible/changelogs or online: https://github.com/ansible/ansible/blob/stable-2.8/changelogs/CHANGELOG-v2. 8.rst Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1635=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): ansible-2.8.1-12.1 References: https://www.suse.com/security/cve/CVE-2018-16837.html https://www.suse.com/security/cve/CVE-2018-16859.html https://www.suse.com/security/cve/CVE-2018-16876.html https://www.suse.com/security/cve/CVE-2019-3828.html https://bugzilla.suse.com/1109957 https://bugzilla.suse.com/1112959 https://bugzilla.suse.com/1118896 https://bugzilla.suse.com/1126503 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1650-1: important: Security update for glib2
by opensuse-security＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Security Update: Security update for glib2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1650-1 Rating: important References: #1103678 #1137001 Cross-References: CVE-2019-12450 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for glib2 fixes the following issues: Security issue fixed: - CVE-2019-12450: Fixed an improper file permission when copy operation takes place (bsc#1137001). Other issue addressed: - glib2 was handling an UNKNOWN connectivity state from NetworkManager as if there was a connection thus giving false positives to PackageKit (bsc#1103678) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1650=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): glib2-debugsource-2.54.3-lp150.3.10.1 glib2-devel-2.54.3-lp150.3.10.1 glib2-devel-debuginfo-2.54.3-lp150.3.10.1 glib2-devel-static-2.54.3-lp150.3.10.1 glib2-tools-2.54.3-lp150.3.10.1 glib2-tools-debuginfo-2.54.3-lp150.3.10.1 libgio-2_0-0-2.54.3-lp150.3.10.1 libgio-2_0-0-debuginfo-2.54.3-lp150.3.10.1 libgio-fam-2.54.3-lp150.3.10.1 libgio-fam-debuginfo-2.54.3-lp150.3.10.1 libglib-2_0-0-2.54.3-lp150.3.10.1 libglib-2_0-0-debuginfo-2.54.3-lp150.3.10.1 libgmodule-2_0-0-2.54.3-lp150.3.10.1 libgmodule-2_0-0-debuginfo-2.54.3-lp150.3.10.1 libgobject-2_0-0-2.54.3-lp150.3.10.1 libgobject-2_0-0-debuginfo-2.54.3-lp150.3.10.1 libgthread-2_0-0-2.54.3-lp150.3.10.1 libgthread-2_0-0-debuginfo-2.54.3-lp150.3.10.1 - openSUSE Leap 15.0 (noarch): gio-branding-upstream-2.54.3-lp150.3.10.1 glib2-lang-2.54.3-lp150.3.10.1 - openSUSE Leap 15.0 (x86_64): glib2-devel-32bit-2.54.3-lp150.3.10.1 glib2-devel-32bit-debuginfo-2.54.3-lp150.3.10.1 glib2-tools-32bit-2.54.3-lp150.3.10.1 glib2-tools-32bit-debuginfo-2.54.3-lp150.3.10.1 libgio-2_0-0-32bit-2.54.3-lp150.3.10.1 libgio-2_0-0-32bit-debuginfo-2.54.3-lp150.3.10.1 libgio-fam-32bit-2.54.3-lp150.3.10.1 libgio-fam-32bit-debuginfo-2.54.3-lp150.3.10.1 libglib-2_0-0-32bit-2.54.3-lp150.3.10.1 libglib-2_0-0-32bit-debuginfo-2.54.3-lp150.3.10.1 libgmodule-2_0-0-32bit-2.54.3-lp150.3.10.1 libgmodule-2_0-0-32bit-debuginfo-2.54.3-lp150.3.10.1 libgobject-2_0-0-32bit-2.54.3-lp150.3.10.1 libgobject-2_0-0-32bit-debuginfo-2.54.3-lp150.3.10.1 libgthread-2_0-0-32bit-2.54.3-lp150.3.10.1 libgthread-2_0-0-32bit-debuginfo-2.54.3-lp150.3.10.1 References: https://www.suse.com/security/cve/CVE-2019-12450.html https://bugzilla.suse.com/1103678 https://bugzilla.suse.com/1137001 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1649-1: moderate: Security update for exempi
by opensuse-security＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Security Update: Security update for exempi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1649-1 Rating: moderate References: #1098946 Cross-References: CVE-2018-12648 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for exempi fixes the following issues: - CVE-2018-12648: Fixed a NULL pointer dereference (crash) issue when processing webp files (bsc#1098946). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1649=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): exempi-debugsource-2.4.5-lp150.2.3.1 exempi-tools-2.4.5-lp150.2.3.1 exempi-tools-debuginfo-2.4.5-lp150.2.3.1 libexempi-devel-2.4.5-lp150.2.3.1 libexempi3-2.4.5-lp150.2.3.1 libexempi3-debuginfo-2.4.5-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libexempi3-32bit-2.4.5-lp150.2.3.1 libexempi3-32bit-debuginfo-2.4.5-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-12648.html https://bugzilla.suse.com/1098946 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1645-1: important: Security update for sqlite3
by opensuse-security＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Security Update: Security update for sqlite3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1645-1 Rating: important References: #1136976 Cross-References: CVE-2019-8457 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for sqlite3 fixes the following issues: Security issue fixed: - CVE-2019-8457: Fixed a Heap out-of-bound read in rtreenode() when handling invalid rtree tables (bsc#1136976). This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1645=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libsqlite3-0-3.8.10.2-11.10.1 libsqlite3-0-debuginfo-3.8.10.2-11.10.1 sqlite3-3.8.10.2-11.10.1 sqlite3-debuginfo-3.8.10.2-11.10.1 sqlite3-debugsource-3.8.10.2-11.10.1 sqlite3-devel-3.8.10.2-11.10.1 - openSUSE Leap 42.3 (x86_64): libsqlite3-0-32bit-3.8.10.2-11.10.1 libsqlite3-0-debuginfo-32bit-3.8.10.2-11.10.1 - openSUSE Leap 42.3 (noarch): sqlite3-doc-3.8.10.2-11.10.1 References: https://www.suse.com/security/cve/CVE-2019-8457.html https://bugzilla.suse.com/1136976 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1646-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1646-1 Rating: moderate References: #1136021 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for wireshark to version 2.4.15 fixes the following issues: Security issue fixed: - Fixed a denial of service in the dissection engine (bsc#1136021). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1646=1 Package List: - openSUSE Leap 42.3 (x86_64): libwireshark9-2.4.15-56.1 libwireshark9-debuginfo-2.4.15-56.1 libwiretap7-2.4.15-56.1 libwiretap7-debuginfo-2.4.15-56.1 libwscodecs1-2.4.15-56.1 libwscodecs1-debuginfo-2.4.15-56.1 libwsutil8-2.4.15-56.1 libwsutil8-debuginfo-2.4.15-56.1 wireshark-2.4.15-56.1 wireshark-debuginfo-2.4.15-56.1 wireshark-debugsource-2.4.15-56.1 wireshark-devel-2.4.15-56.1 wireshark-gtk-2.4.15-56.1 wireshark-gtk-debuginfo-2.4.15-56.1 wireshark-ui-qt-2.4.15-56.1 wireshark-ui-qt-debuginfo-2.4.15-56.1 References: https://bugzilla.suse.com/1136021 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1640-1: moderate: Security update for libssh2_org
by opensuse-security＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Security Update: Security update for libssh2_org ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1640-1 Rating: moderate References: #1128481 #1136570 Cross-References: CVE-2019-3860 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for libssh2_org fixes the following issues: - Fix the previous fix for CVE-2019-3860 (bsc#1136570, bsc#1128481) (Out-of-bounds reads with specially crafted SFTP packets) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1640=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libssh2-1-1.4.3-19.9.1 libssh2-1-debuginfo-1.4.3-19.9.1 libssh2-devel-1.4.3-19.9.1 libssh2_org-debugsource-1.4.3-19.9.1 - openSUSE Leap 42.3 (x86_64): libssh2-1-32bit-1.4.3-19.9.1 libssh2-1-debuginfo-32bit-1.4.3-19.9.1 References: https://www.suse.com/security/cve/CVE-2019-3860.html https://bugzilla.suse.com/1128481 https://bugzilla.suse.com/1136570 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1633-1: moderate: Security update for SDL2
by opensuse-security＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Security Update: Security update for SDL2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1633-1 Rating: moderate References: #1124825 #1134135 Cross-References: CVE-2019-7637 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for SDL2 fixes the following issues: - Remove the fix for CVE-2019-7637, the modification of function SDL_CalculatePitch is only suited for SDL not SDL2, and breaks SDL2 software. (bsc#1134135) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1633=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): SDL2-debugsource-2.0.8-lp151.4.3.1 libSDL2-2_0-0-2.0.8-lp151.4.3.1 libSDL2-2_0-0-debuginfo-2.0.8-lp151.4.3.1 libSDL2-devel-2.0.8-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): libSDL2-2_0-0-32bit-2.0.8-lp151.4.3.1 libSDL2-2_0-0-32bit-debuginfo-2.0.8-lp151.4.3.1 libSDL2-devel-32bit-2.0.8-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-7637.html https://bugzilla.suse.com/1124825 https://bugzilla.suse.com/1134135 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1657-1: moderate: Security update for exempi
by opensuse-security＠opensuse.org 27 Jun '19

27 Jun '19

openSUSE Security Update: Security update for exempi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1657-1 Rating: moderate References: #1098946 Cross-References: CVE-2018-12648 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for exempi fixes the following issues: - CVE-2018-12648: Fixed a NULL pointer dereference (crash) issue when processing webp files (bsc#1098946). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1657=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): exempi-debugsource-2.4.5-lp151.3.3.1 exempi-tools-2.4.5-lp151.3.3.1 exempi-tools-debuginfo-2.4.5-lp151.3.3.1 libexempi-devel-2.4.5-lp151.3.3.1 libexempi3-2.4.5-lp151.3.3.1 libexempi3-debuginfo-2.4.5-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libexempi3-32bit-2.4.5-lp151.3.3.1 libexempi3-32bit-debuginfo-2.4.5-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-12648.html https://bugzilla.suse.com/1098946 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1629-1: moderate: Security update for libmediainfo
by opensuse-security＠opensuse.org 26 Jun '19

26 Jun '19

openSUSE Security Update: Security update for libmediainfo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1629-1 Rating: moderate References: #1133156 #1133157 Cross-References: CVE-2019-11372 CVE-2019-11373 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libmediainfo fixes the following issues: * CVE-2019-11373: Fixed out-of-bounds read in function File__Analyze:Get_L8 (boo#1133156) * CVE-2019-11372: Fixed out-of-bounds read in function MediaInfoLib:File__Tags_Helper:Synched_Test (boo#1133157) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1629=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1629=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1629=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libmediainfo-debugsource-0.7.96-2.3.1 libmediainfo-devel-0.7.96-2.3.1 libmediainfo0-0.7.96-2.3.1 libmediainfo0-debuginfo-0.7.96-2.3.1 - openSUSE Leap 42.3 (x86_64): libmediainfo0-32bit-0.7.96-2.3.1 libmediainfo0-debuginfo-32bit-0.7.96-2.3.1 - openSUSE Leap 15.0 (i586 x86_64): libmediainfo-debugsource-18.03-lp150.2.3.1 libmediainfo-devel-18.03-lp150.2.3.1 libmediainfo0-18.03-lp150.2.3.1 libmediainfo0-debuginfo-18.03-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libmediainfo0-32bit-18.03-lp150.2.3.1 libmediainfo0-32bit-debuginfo-18.03-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libmediainfo-devel-18.03-bp150.3.3.1 libmediainfo0-18.03-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libmediainfo0-64bit-18.03-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-11372.html https://www.suse.com/security/cve/CVE-2019-11373.html https://bugzilla.suse.com/1133156 https://bugzilla.suse.com/1133157 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1623-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 25 Jun '19

25 Jun '19

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1623-1 Rating: moderate References: #1138425 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for GraphicsMagick fixes the following issues: - disable indirect reads that disclosed file contents from the local system (boo#1138425) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1623=1 Package List: - openSUSE Backports SLE-15 (x86_64): GraphicsMagick-1.3.29-bp150.2.27.1 GraphicsMagick-devel-1.3.29-bp150.2.27.1 libGraphicsMagick++-Q16-12-1.3.29-bp150.2.27.1 libGraphicsMagick++-devel-1.3.29-bp150.2.27.1 libGraphicsMagick-Q16-3-1.3.29-bp150.2.27.1 libGraphicsMagick3-config-1.3.29-bp150.2.27.1 libGraphicsMagickWand-Q16-2-1.3.29-bp150.2.27.1 perl-GraphicsMagick-1.3.29-bp150.2.27.1 References: https://bugzilla.suse.com/1138425 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0