June 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:1553-1: moderate: Security update for rubygem-rack
by opensuse-security＠opensuse.org 13 Jun '19

13 Jun '19

openSUSE Security Update: Security update for rubygem-rack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1553-1 Rating: moderate References: #1114828 #1116600 Cross-References: CVE-2018-16471 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for rubygem-rack fixes the following issues: Security issued fixed: - CVE-2018-16471: Fixed a cross-site scripting vulnerability via 'scheme' method (bsc#1116600). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1553=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ruby2.1-rubygem-rack-1.6.11-7.3.1 ruby2.1-rubygem-rack-doc-1.6.11-7.3.1 ruby2.1-rubygem-rack-testsuite-1.6.11-7.3.1 ruby2.2-rubygem-rack-1.6.11-7.3.1 ruby2.2-rubygem-rack-doc-1.6.11-7.3.1 ruby2.2-rubygem-rack-testsuite-1.6.11-7.3.1 ruby2.3-rubygem-rack-1.6.11-7.3.1 ruby2.3-rubygem-rack-doc-1.6.11-7.3.1 ruby2.3-rubygem-rack-testsuite-1.6.11-7.3.1 ruby2.4-rubygem-rack-1.6.11-7.3.1 ruby2.4-rubygem-rack-doc-1.6.11-7.3.1 ruby2.4-rubygem-rack-testsuite-1.6.11-7.3.1 References: https://www.suse.com/security/cve/CVE-2018-16471.html https://bugzilla.suse.com/1114828 https://bugzilla.suse.com/1116600 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1551-1: important: Security update for neovim
by opensuse-security＠opensuse.org 13 Jun '19

13 Jun '19

openSUSE Security Update: Security update for neovim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1551-1 Rating: important References: #1137443 Cross-References: CVE-2019-12735 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for neovim fixes the following issues: Security issue fixed: - CVE-2019-12735: Fixed a potential arbitrary code execution vulnerability in getchar.c (bsc#1137443). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1551=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1551=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1551=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1551=1 Package List: - openSUSE Leap 42.3 (x86_64): neovim-0.2.0-6.1 neovim-debuginfo-0.2.0-6.1 neovim-debugsource-0.2.0-6.1 - openSUSE Leap 42.3 (noarch): neovim-lang-0.2.0-6.1 - openSUSE Leap 15.1 (noarch): neovim-lang-0.3.5-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): neovim-0.3.5-lp151.2.3.1 neovim-debuginfo-0.3.5-lp151.2.3.1 neovim-debugsource-0.3.5-lp151.2.3.1 - openSUSE Leap 15.0 (x86_64): neovim-0.3.1-lp150.7.1 neovim-debuginfo-0.3.1-lp150.7.1 neovim-debugsource-0.3.1-lp150.7.1 - openSUSE Leap 15.0 (noarch): neovim-lang-0.3.1-lp150.7.1 - openSUSE Backports SLE-15 (x86_64): neovim-0.3.1-bp150.2.6.1 - openSUSE Backports SLE-15 (noarch): neovim-lang-0.3.1-bp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-12735.html https://bugzilla.suse.com/1137443 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1547-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 11 Jun '19

11 Jun '19

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1547-1 Rating: important References: #1122212 Cross-References: CVE-2018-0734 CVE-2018-11763 CVE-2018-11784 CVE-2018-3309 CVE-2019-2446 CVE-2019-2448 CVE-2019-2450 CVE-2019-2451 CVE-2019-2500 CVE-2019-2501 CVE-2019-2504 CVE-2019-2505 CVE-2019-2506 CVE-2019-2508 CVE-2019-2509 CVE-2019-2511 CVE-2019-2520 CVE-2019-2521 CVE-2019-2522 CVE-2019-2523 CVE-2019-2524 CVE-2019-2525 CVE-2019-2526 CVE-2019-2527 CVE-2019-2548 CVE-2019-2552 CVE-2019-2553 CVE-2019-2554 CVE-2019-2555 CVE-2019-2556 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 30 vulnerabilities is now available. Description: This update for virtualbox to version 5.2.24 fixes the following issues: Multiple security issues fixed: CVE-2019-2500, CVE-2019-2524, CVE-2019-2552, CVE-2018-3309, CVE-2019-2520 CVE-2019-2521, CVE-2019-2522, CVE-2019-2523, CVE-2019-2526, CVE-2019-2548 CVE-2018-11763, CVE-2019-2511, CVE-2019-2508, CVE-2019-2509, CVE-2019-2527 CVE-2019-2450, CVE-2019-2451, CVE-2019-2555, CVE-2019-2554, CVE-2019-2556 CVE-2018-11784, CVE-2018-0734, CVE-2019-2525, CVE-2019-2446, CVE-2019-2448 CVE-2019-2501, CVE-2019-2504, CVE-2019-2505, CVE-2019-2506, and CVE-2019-2553 (bsc#1122212). Other issues fixed: - Linux Additions: fix for building vboxvideo on EL 7.6 standard kernel, contributed by Robert Conde - USB: fixed a problem causing failures attaching SuperSpeed devices which report USB version 3.1 (rather than 3.0) on Windows hosts - Audio: added support for surround speaker setups used by Windows 10 Build 1809 - Linux hosts: fixed conflict between Debian and Oracle build desktop files - Linux guests: fixed building drivers on SLES 12.4 - Linux guests: fixed building shared folder driver with older kernels Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1547=1 Package List: - openSUSE Leap 15.0 (x86_64): python3-virtualbox-5.2.24-lp150.4.33.1 python3-virtualbox-debuginfo-5.2.24-lp150.4.33.1 virtualbox-5.2.24-lp150.4.33.1 virtualbox-debuginfo-5.2.24-lp150.4.33.1 virtualbox-debugsource-5.2.24-lp150.4.33.1 virtualbox-devel-5.2.24-lp150.4.33.1 virtualbox-guest-kmp-default-5.2.24_k4.12.14_lp150.12.61-lp150.4.33.1 virtualbox-guest-kmp-default-debuginfo-5.2.24_k4.12.14_lp150.12.61-lp150.4.33.1 virtualbox-guest-tools-5.2.24-lp150.4.33.1 virtualbox-guest-tools-debuginfo-5.2.24-lp150.4.33.1 virtualbox-guest-x11-5.2.24-lp150.4.33.1 virtualbox-guest-x11-debuginfo-5.2.24-lp150.4.33.1 virtualbox-host-kmp-default-5.2.24_k4.12.14_lp150.12.61-lp150.4.33.1 virtualbox-host-kmp-default-debuginfo-5.2.24_k4.12.14_lp150.12.61-lp150.4.33.1 virtualbox-qt-5.2.24-lp150.4.33.1 virtualbox-qt-debuginfo-5.2.24-lp150.4.33.1 virtualbox-vnc-5.2.24-lp150.4.33.1 virtualbox-websrv-5.2.24-lp150.4.33.1 virtualbox-websrv-debuginfo-5.2.24-lp150.4.33.1 - openSUSE Leap 15.0 (noarch): virtualbox-guest-desktop-icons-5.2.24-lp150.4.33.1 virtualbox-guest-source-5.2.24-lp150.4.33.1 virtualbox-host-source-5.2.24-lp150.4.33.1 References: https://www.suse.com/security/cve/CVE-2018-0734.html https://www.suse.com/security/cve/CVE-2018-11763.html https://www.suse.com/security/cve/CVE-2018-11784.html https://www.suse.com/security/cve/CVE-2018-3309.html https://www.suse.com/security/cve/CVE-2019-2446.html https://www.suse.com/security/cve/CVE-2019-2448.html https://www.suse.com/security/cve/CVE-2019-2450.html https://www.suse.com/security/cve/CVE-2019-2451.html https://www.suse.com/security/cve/CVE-2019-2500.html https://www.suse.com/security/cve/CVE-2019-2501.html https://www.suse.com/security/cve/CVE-2019-2504.html https://www.suse.com/security/cve/CVE-2019-2505.html https://www.suse.com/security/cve/CVE-2019-2506.html https://www.suse.com/security/cve/CVE-2019-2508.html https://www.suse.com/security/cve/CVE-2019-2509.html https://www.suse.com/security/cve/CVE-2019-2511.html https://www.suse.com/security/cve/CVE-2019-2520.html https://www.suse.com/security/cve/CVE-2019-2521.html https://www.suse.com/security/cve/CVE-2019-2522.html https://www.suse.com/security/cve/CVE-2019-2523.html https://www.suse.com/security/cve/CVE-2019-2524.html https://www.suse.com/security/cve/CVE-2019-2525.html https://www.suse.com/security/cve/CVE-2019-2526.html https://www.suse.com/security/cve/CVE-2019-2527.html https://www.suse.com/security/cve/CVE-2019-2548.html https://www.suse.com/security/cve/CVE-2019-2552.html https://www.suse.com/security/cve/CVE-2019-2553.html https://www.suse.com/security/cve/CVE-2019-2554.html https://www.suse.com/security/cve/CVE-2019-2555.html https://www.suse.com/security/cve/CVE-2019-2556.html https://bugzilla.suse.com/1122212 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1534-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 10 Jun '19

10 Jun '19

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1534-1 Rating: important References: #1135824 Cross-References: CVE-2018-18511 CVE-2019-11691 CVE-2019-11692 CVE-2019-11693 CVE-2019-11694 CVE-2019-11698 CVE-2019-5798 CVE-2019-7317 CVE-2019-9797 CVE-2019-9800 CVE-2019-9815 CVE-2019-9816 CVE-2019-9817 CVE-2019-9818 CVE-2019-9819 CVE-2019-9820 CVE-2019-9821 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: MozillaFirefox was updated to 60.7.0esr (boo#1135824 MFSA 2019-14): * CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext * CVE-2019-11691: Use-after-free in XMLHttpRequest * CVE-2019-11692: Use-after-free removing listeners in the event listener manager * CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux * CVE-2019-11694: (Windows only) Uninitialized memory memory leakage in Windows sandbox * CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks * CVE-2019-5798: Out-of-bounds read in Skia * CVE-2019-7317: Use-after-free in png_image_free of libpng library * CVE-2019-9797: Cross-origin theft of images with createImageBitmap * CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 * CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS * CVE-2019-9816: Type confusion with object groups and UnboxedObjects * CVE-2019-9817: Stealing of cross-domain images using canvas * CVE-2019-9818: (Windows only) Use-after-free in crash generation server * CVE-2019-9819: Compartment mismatch with fetch API * CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell * CVE-2019-9821: Use-after-free in AssertWorkerThread Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1534=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1534=1 Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-60.7.0-145.2 MozillaFirefox-branding-upstream-60.7.0-145.2 MozillaFirefox-buildsymbols-60.7.0-145.2 MozillaFirefox-debuginfo-60.7.0-145.2 MozillaFirefox-debugsource-60.7.0-145.2 MozillaFirefox-devel-60.7.0-145.2 MozillaFirefox-translations-common-60.7.0-145.2 MozillaFirefox-translations-other-60.7.0-145.2 - openSUSE Leap 15.0 (x86_64): MozillaFirefox-60.7.0-lp150.3.54.5 MozillaFirefox-branding-upstream-60.7.0-lp150.3.54.5 MozillaFirefox-buildsymbols-60.7.0-lp150.3.54.5 MozillaFirefox-debuginfo-60.7.0-lp150.3.54.5 MozillaFirefox-debugsource-60.7.0-lp150.3.54.5 MozillaFirefox-devel-60.7.0-lp150.3.54.5 MozillaFirefox-translations-common-60.7.0-lp150.3.54.5 MozillaFirefox-translations-other-60.7.0-lp150.3.54.5 References: https://www.suse.com/security/cve/CVE-2018-18511.html https://www.suse.com/security/cve/CVE-2019-11691.html https://www.suse.com/security/cve/CVE-2019-11692.html https://www.suse.com/security/cve/CVE-2019-11693.html https://www.suse.com/security/cve/CVE-2019-11694.html https://www.suse.com/security/cve/CVE-2019-11698.html https://www.suse.com/security/cve/CVE-2019-5798.html https://www.suse.com/security/cve/CVE-2019-7317.html https://www.suse.com/security/cve/CVE-2019-9797.html https://www.suse.com/security/cve/CVE-2019-9800.html https://www.suse.com/security/cve/CVE-2019-9815.html https://www.suse.com/security/cve/CVE-2019-9816.html https://www.suse.com/security/cve/CVE-2019-9817.html https://www.suse.com/security/cve/CVE-2019-9818.html https://www.suse.com/security/cve/CVE-2019-9819.html https://www.suse.com/security/cve/CVE-2019-9820.html https://www.suse.com/security/cve/CVE-2019-9821.html https://bugzilla.suse.com/1135824 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1535-1: moderate: Security update for bubblewrap
by opensuse-security＠opensuse.org 10 Jun '19

10 Jun '19

openSUSE Security Update: Security update for bubblewrap ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1535-1 Rating: moderate References: #1136958 Cross-References: CVE-2019-12439 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bubblewrap to version 0.3.3 fixes the following issue: Security issue fixed: - CVE-2019-12439: Fixed a temporary directory misuse as mount point which could have allowed local user to prevent others from running bubblewrap. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1535=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): bubblewrap-0.3.3-lp151.2.3.1 bubblewrap-debuginfo-0.3.3-lp151.2.3.1 bubblewrap-debugsource-0.3.3-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-12439.html https://bugzilla.suse.com/1136958 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1533-1: important: Security update for bind
by opensuse-security＠opensuse.org 10 Jun '19

10 Jun '19

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1533-1 Rating: important References: #1104129 #1126068 #1126069 #1133185 Cross-References: CVE-2018-5740 CVE-2018-5743 CVE-2018-5745 CVE-2019-6465 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for bind fixes the following issues: Security issues fixed: - CVE-2019-6465: Fixed an issue where controls for zone transfers may not be properly applied to Dynamically Loadable Zones (bsc#1126069). - CVE-2018-5745: Fixed a denial of service vulnerability if a trust anchor rolls over to an unsupported key algorithm when using managed-keys (bsc#1126068). - CVE-2018-5743: Fixed a denial of service vulnerability which could be caused by to many simultaneous TCP connections (bsc#1133185). - CVE-2018-5740: Fixed a denial of service vulnerability in the "deny-answer-aliases" feature (bsc#1104129). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1533=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1533=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): bind-9.11.2-lp151.11.3.1 bind-chrootenv-9.11.2-lp151.11.3.1 bind-debuginfo-9.11.2-lp151.11.3.1 bind-debugsource-9.11.2-lp151.11.3.1 bind-devel-9.11.2-lp151.11.3.1 bind-lwresd-9.11.2-lp151.11.3.1 bind-lwresd-debuginfo-9.11.2-lp151.11.3.1 bind-utils-9.11.2-lp151.11.3.1 bind-utils-debuginfo-9.11.2-lp151.11.3.1 libbind9-160-9.11.2-lp151.11.3.1 libbind9-160-debuginfo-9.11.2-lp151.11.3.1 libdns169-9.11.2-lp151.11.3.1 libdns169-debuginfo-9.11.2-lp151.11.3.1 libirs-devel-9.11.2-lp151.11.3.1 libirs160-9.11.2-lp151.11.3.1 libirs160-debuginfo-9.11.2-lp151.11.3.1 libisc166-9.11.2-lp151.11.3.1 libisc166-debuginfo-9.11.2-lp151.11.3.1 libisccc160-9.11.2-lp151.11.3.1 libisccc160-debuginfo-9.11.2-lp151.11.3.1 libisccfg160-9.11.2-lp151.11.3.1 libisccfg160-debuginfo-9.11.2-lp151.11.3.1 liblwres160-9.11.2-lp151.11.3.1 liblwres160-debuginfo-9.11.2-lp151.11.3.1 - openSUSE Leap 15.1 (x86_64): bind-devel-32bit-9.11.2-lp151.11.3.1 libbind9-160-32bit-9.11.2-lp151.11.3.1 libbind9-160-32bit-debuginfo-9.11.2-lp151.11.3.1 libdns169-32bit-9.11.2-lp151.11.3.1 libdns169-32bit-debuginfo-9.11.2-lp151.11.3.1 libirs160-32bit-9.11.2-lp151.11.3.1 libirs160-32bit-debuginfo-9.11.2-lp151.11.3.1 libisc166-32bit-9.11.2-lp151.11.3.1 libisc166-32bit-debuginfo-9.11.2-lp151.11.3.1 libisccc160-32bit-9.11.2-lp151.11.3.1 libisccc160-32bit-debuginfo-9.11.2-lp151.11.3.1 libisccfg160-32bit-9.11.2-lp151.11.3.1 libisccfg160-32bit-debuginfo-9.11.2-lp151.11.3.1 liblwres160-32bit-9.11.2-lp151.11.3.1 liblwres160-32bit-debuginfo-9.11.2-lp151.11.3.1 - openSUSE Leap 15.1 (noarch): bind-doc-9.11.2-lp151.11.3.1 python3-bind-9.11.2-lp151.11.3.1 - openSUSE Leap 15.0 (i586 x86_64): bind-9.11.2-lp150.8.13.1 bind-chrootenv-9.11.2-lp150.8.13.1 bind-debuginfo-9.11.2-lp150.8.13.1 bind-debugsource-9.11.2-lp150.8.13.1 bind-devel-9.11.2-lp150.8.13.1 bind-lwresd-9.11.2-lp150.8.13.1 bind-lwresd-debuginfo-9.11.2-lp150.8.13.1 bind-utils-9.11.2-lp150.8.13.1 bind-utils-debuginfo-9.11.2-lp150.8.13.1 libbind9-160-9.11.2-lp150.8.13.1 libbind9-160-debuginfo-9.11.2-lp150.8.13.1 libdns169-9.11.2-lp150.8.13.1 libdns169-debuginfo-9.11.2-lp150.8.13.1 libirs-devel-9.11.2-lp150.8.13.1 libirs160-9.11.2-lp150.8.13.1 libirs160-debuginfo-9.11.2-lp150.8.13.1 libisc166-9.11.2-lp150.8.13.1 libisc166-debuginfo-9.11.2-lp150.8.13.1 libisccc160-9.11.2-lp150.8.13.1 libisccc160-debuginfo-9.11.2-lp150.8.13.1 libisccfg160-9.11.2-lp150.8.13.1 libisccfg160-debuginfo-9.11.2-lp150.8.13.1 liblwres160-9.11.2-lp150.8.13.1 liblwres160-debuginfo-9.11.2-lp150.8.13.1 - openSUSE Leap 15.0 (noarch): bind-doc-9.11.2-lp150.8.13.1 python3-bind-9.11.2-lp150.8.13.1 - openSUSE Leap 15.0 (x86_64): bind-devel-32bit-9.11.2-lp150.8.13.1 libbind9-160-32bit-9.11.2-lp150.8.13.1 libbind9-160-32bit-debuginfo-9.11.2-lp150.8.13.1 libdns169-32bit-9.11.2-lp150.8.13.1 libdns169-32bit-debuginfo-9.11.2-lp150.8.13.1 libirs160-32bit-9.11.2-lp150.8.13.1 libirs160-32bit-debuginfo-9.11.2-lp150.8.13.1 libisc166-32bit-9.11.2-lp150.8.13.1 libisc166-32bit-debuginfo-9.11.2-lp150.8.13.1 libisccc160-32bit-9.11.2-lp150.8.13.1 libisccc160-32bit-debuginfo-9.11.2-lp150.8.13.1 libisccfg160-32bit-9.11.2-lp150.8.13.1 libisccfg160-32bit-debuginfo-9.11.2-lp150.8.13.1 liblwres160-32bit-9.11.2-lp150.8.13.1 liblwres160-32bit-debuginfo-9.11.2-lp150.8.13.1 References: https://www.suse.com/security/cve/CVE-2018-5740.html https://www.suse.com/security/cve/CVE-2018-5743.html https://www.suse.com/security/cve/CVE-2018-5745.html https://www.suse.com/security/cve/CVE-2019-6465.html https://bugzilla.suse.com/1104129 https://bugzilla.suse.com/1126068 https://bugzilla.suse.com/1126069 https://bugzilla.suse.com/1133185 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1532-1: important: Security update for bind
by opensuse-security＠opensuse.org 10 Jun '19

10 Jun '19

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1532-1 Rating: important References: #1104129 #1126068 #1126069 #1133185 Cross-References: CVE-2018-5740 CVE-2018-5743 CVE-2018-5745 CVE-2019-6465 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for bind fixes the following issues: Security issues fixed: - CVE-2018-5740: Fixed a denial of service vulnerability in the "deny-answer-aliases" feature (bsc#1104129). - CVE-2019-6465: Fixed an issue where controls for zone transfers may not be properly applied to Dynamically Loadable Zones (bsc#1126069). - CVE-2018-5745: An assertion failure can occur if a trust anchor rolls over to an unsupported key algorithm when using managed-keys. (bsc#1126068) - CVE-2018-5743: Limiting simultaneous TCP clients is ineffective. (bsc#1133185) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1532=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): bind-9.9.9P1-56.1 bind-chrootenv-9.9.9P1-56.1 bind-debuginfo-9.9.9P1-56.1 bind-debugsource-9.9.9P1-56.1 bind-devel-9.9.9P1-56.1 bind-libs-9.9.9P1-56.1 bind-libs-debuginfo-9.9.9P1-56.1 bind-lwresd-9.9.9P1-56.1 bind-lwresd-debuginfo-9.9.9P1-56.1 bind-utils-9.9.9P1-56.1 bind-utils-debuginfo-9.9.9P1-56.1 - openSUSE Leap 42.3 (x86_64): bind-libs-32bit-9.9.9P1-56.1 bind-libs-debuginfo-32bit-9.9.9P1-56.1 - openSUSE Leap 42.3 (noarch): bind-doc-9.9.9P1-56.1 References: https://www.suse.com/security/cve/CVE-2018-5740.html https://www.suse.com/security/cve/CVE-2018-5743.html https://www.suse.com/security/cve/CVE-2018-5745.html https://www.suse.com/security/cve/CVE-2019-6465.html https://bugzilla.suse.com/1104129 https://bugzilla.suse.com/1126068 https://bugzilla.suse.com/1126069 https://bugzilla.suse.com/1133185 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1527-1: important: Security update for rmt-server
by opensuse-security＠opensuse.org 07 Jun '19

07 Jun '19

openSUSE Security Update: Security update for rmt-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1527-1 Rating: important References: #1107806 #1117722 #1118745 #1125770 #1128858 #1129271 #1129392 #1132160 #1132690 #1134190 #1134428 #1135222 Cross-References: CVE-2019-11068 CVE-2019-5419 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has 10 fixes is now available. Description: This update for rmt-server to version 2.1.4 fixes the following issues: - Fix duplicate nginx location in rmt-server-pubcloud (bsc#1135222) - Mirror additional repos that were enabled during mirroring (bsc#1132690) - Make service IDs consistent across different RMT instances (bsc#1134428) - Make SMT data import scripts faster (bsc#1134190) - Fix incorrect triggering of registration sharing (bsc#1129392) - Fix license mirroring issue in some non-SUSE repositories (bsc#1128858) - Set CURLOPT_LOW_SPEED_LIMIT to prevent downloads from getting stuck (bsc#1107806) - Truncate the RMT lockfile when writing a new PID (bsc#1125770) - Fix missing trailing slashes on custom repository import from SMT (bsc#1118745) - Zypper authentication plugin (fate#326629) - Instance verification plugin in rmt-server-pubcloud (fate#326629) - Update dependencies to fix vulnerabilities in rails (CVE-2019-5419, bsc#1129271) and nokogiri (CVE-2019-11068, bsc#1132160) - Allow RMT registration to work under HTTP as well as HTTPS. - Offline migration from SLE 15 to SLE 15 SP1 will add Python2 module - Online migrations will automatically add additional modules to the client systems depending on the base product - Supply log severity to journald - Breaking Change: Added headers to generated CSV files This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1527=1 Package List: - openSUSE Leap 15.0 (x86_64): rmt-server-2.1.4-lp150.2.16.1 rmt-server-debuginfo-2.1.4-lp150.2.16.1 rmt-server-pubcloud-2.1.4-lp150.2.16.1 References: https://www.suse.com/security/cve/CVE-2019-11068.html https://www.suse.com/security/cve/CVE-2019-5419.html https://bugzilla.suse.com/1107806 https://bugzilla.suse.com/1117722 https://bugzilla.suse.com/1118745 https://bugzilla.suse.com/1125770 https://bugzilla.suse.com/1128858 https://bugzilla.suse.com/1129271 https://bugzilla.suse.com/1129392 https://bugzilla.suse.com/1132160 https://bugzilla.suse.com/1132690 https://bugzilla.suse.com/1134190 https://bugzilla.suse.com/1134428 https://bugzilla.suse.com/1135222 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1528-1: moderate: Security update for evolution
by opensuse-security＠opensuse.org 07 Jun '19

07 Jun '19

openSUSE Security Update: Security update for evolution ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1528-1 Rating: moderate References: #1125230 Cross-References: CVE-2018-15587 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for evolution fixes the following issue: Security issue fixed: - CVE-2018-15587: Fixed OpenPGP signatures spoofing via specially crafted email that contains a valid signature (bsc#1125230). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1528=1 Package List: - openSUSE Leap 42.3 (x86_64): evolution-3.22.6-5.9.1 evolution-debuginfo-3.22.6-5.9.1 evolution-debugsource-3.22.6-5.9.1 evolution-devel-3.22.6-5.9.1 evolution-plugin-bogofilter-3.22.6-5.9.1 evolution-plugin-bogofilter-debuginfo-3.22.6-5.9.1 evolution-plugin-pst-import-3.22.6-5.9.1 evolution-plugin-pst-import-debuginfo-3.22.6-5.9.1 evolution-plugin-spamassassin-3.22.6-5.9.1 evolution-plugin-spamassassin-debuginfo-3.22.6-5.9.1 glade-catalog-evolution-3.22.6-5.9.1 glade-catalog-evolution-debuginfo-3.22.6-5.9.1 - openSUSE Leap 42.3 (noarch): evolution-lang-3.22.6-5.9.1 References: https://www.suse.com/security/cve/CVE-2018-15587.html https://bugzilla.suse.com/1125230 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1529-1: moderate: Security update for gnome-shell
by opensuse-security＠opensuse.org 07 Jun '19

07 Jun '19

openSUSE Security Update: Security update for gnome-shell ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1529-1 Rating: moderate References: #1124493 Cross-References: CVE-2019-3820 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gnome-shell fixes the following issues: Security issue fixed: - CVE-2019-3820: Fixed a partial lock screen bypass (bsc#1124493). Fixed bugs: - Remove sessionList of endSessionDialog for security reasons (jsc#SLE-6660). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1529=1 Package List: - openSUSE Leap 42.3 (x86_64): gnome-shell-3.20.4-22.1 gnome-shell-browser-plugin-3.20.4-22.1 gnome-shell-browser-plugin-debuginfo-3.20.4-22.1 gnome-shell-calendar-3.20.4-22.1 gnome-shell-calendar-debuginfo-3.20.4-22.1 gnome-shell-debuginfo-3.20.4-22.1 gnome-shell-debugsource-3.20.4-22.1 gnome-shell-devel-3.20.4-22.1 - openSUSE Leap 42.3 (noarch): gnome-shell-lang-3.20.4-22.1 References: https://www.suse.com/security/cve/CVE-2019-3820.html https://bugzilla.suse.com/1124493 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0