June 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:1503-1: moderate: Security update for php5
by opensuse-security＠opensuse.org 03 Jun '19

03 Jun '19

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1503-1 Rating: moderate References: #1128883 #1128886 #1128887 #1128889 #1128892 #1132837 #1132838 #1134322 Cross-References: CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-9637 CVE-2019-9638 CVE-2019-9639 CVE-2019-9640 CVE-2019-9675 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for php5 fixes the following issues: Security issues fixed: - CVE-2019-11034: Fixed a heap-buffer overflow in php_ifd_get32si() (bsc#1132838). - CVE-2019-11035: Fixed a heap-buffer overflow in exif_iif_add_value() (bsc#1132837). - CVE-2019-9637: Fixed a potential information disclosure in rename() (bsc#1128892). - CVE-2019-9675: Fixed a potential buffer overflow in phar_tar_writeheaders_int() (bsc#1128886). - CVE-2019-9638: Fixed an uninitialized read in exif_process_IFD_in_MAKERNOTE() related to value_len (bsc#1128889). - CVE-2019-9639: Fixed an uninitialized read in exif_process_IFD_in_MAKERNOTE() related to data_len (bsc#1128887). - CVE-2019-9640: Fixed an invalid Read in exif_process_SOFn() (bsc#1128883). - CVE-2019-11036: Fixed buffer over-read in exif_process_IFD_TAG function leading to information disclosure (bsc#1134322). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1503=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php5-5.5.14-118.1 apache2-mod_php5-debuginfo-5.5.14-118.1 php5-5.5.14-118.1 php5-bcmath-5.5.14-118.1 php5-bcmath-debuginfo-5.5.14-118.1 php5-bz2-5.5.14-118.1 php5-bz2-debuginfo-5.5.14-118.1 php5-calendar-5.5.14-118.1 php5-calendar-debuginfo-5.5.14-118.1 php5-ctype-5.5.14-118.1 php5-ctype-debuginfo-5.5.14-118.1 php5-curl-5.5.14-118.1 php5-curl-debuginfo-5.5.14-118.1 php5-dba-5.5.14-118.1 php5-dba-debuginfo-5.5.14-118.1 php5-debuginfo-5.5.14-118.1 php5-debugsource-5.5.14-118.1 php5-devel-5.5.14-118.1 php5-dom-5.5.14-118.1 php5-dom-debuginfo-5.5.14-118.1 php5-enchant-5.5.14-118.1 php5-enchant-debuginfo-5.5.14-118.1 php5-exif-5.5.14-118.1 php5-exif-debuginfo-5.5.14-118.1 php5-fastcgi-5.5.14-118.1 php5-fastcgi-debuginfo-5.5.14-118.1 php5-fileinfo-5.5.14-118.1 php5-fileinfo-debuginfo-5.5.14-118.1 php5-firebird-5.5.14-118.1 php5-firebird-debuginfo-5.5.14-118.1 php5-fpm-5.5.14-118.1 php5-fpm-debuginfo-5.5.14-118.1 php5-ftp-5.5.14-118.1 php5-ftp-debuginfo-5.5.14-118.1 php5-gd-5.5.14-118.1 php5-gd-debuginfo-5.5.14-118.1 php5-gettext-5.5.14-118.1 php5-gettext-debuginfo-5.5.14-118.1 php5-gmp-5.5.14-118.1 php5-gmp-debuginfo-5.5.14-118.1 php5-iconv-5.5.14-118.1 php5-iconv-debuginfo-5.5.14-118.1 php5-imap-5.5.14-118.1 php5-imap-debuginfo-5.5.14-118.1 php5-intl-5.5.14-118.1 php5-intl-debuginfo-5.5.14-118.1 php5-json-5.5.14-118.1 php5-json-debuginfo-5.5.14-118.1 php5-ldap-5.5.14-118.1 php5-ldap-debuginfo-5.5.14-118.1 php5-mbstring-5.5.14-118.1 php5-mbstring-debuginfo-5.5.14-118.1 php5-mcrypt-5.5.14-118.1 php5-mcrypt-debuginfo-5.5.14-118.1 php5-mssql-5.5.14-118.1 php5-mssql-debuginfo-5.5.14-118.1 php5-mysql-5.5.14-118.1 php5-mysql-debuginfo-5.5.14-118.1 php5-odbc-5.5.14-118.1 php5-odbc-debuginfo-5.5.14-118.1 php5-opcache-5.5.14-118.1 php5-opcache-debuginfo-5.5.14-118.1 php5-openssl-5.5.14-118.1 php5-openssl-debuginfo-5.5.14-118.1 php5-pcntl-5.5.14-118.1 php5-pcntl-debuginfo-5.5.14-118.1 php5-pdo-5.5.14-118.1 php5-pdo-debuginfo-5.5.14-118.1 php5-pgsql-5.5.14-118.1 php5-pgsql-debuginfo-5.5.14-118.1 php5-phar-5.5.14-118.1 php5-phar-debuginfo-5.5.14-118.1 php5-posix-5.5.14-118.1 php5-posix-debuginfo-5.5.14-118.1 php5-pspell-5.5.14-118.1 php5-pspell-debuginfo-5.5.14-118.1 php5-readline-5.5.14-118.1 php5-readline-debuginfo-5.5.14-118.1 php5-shmop-5.5.14-118.1 php5-shmop-debuginfo-5.5.14-118.1 php5-snmp-5.5.14-118.1 php5-snmp-debuginfo-5.5.14-118.1 php5-soap-5.5.14-118.1 php5-soap-debuginfo-5.5.14-118.1 php5-sockets-5.5.14-118.1 php5-sockets-debuginfo-5.5.14-118.1 php5-sqlite-5.5.14-118.1 php5-sqlite-debuginfo-5.5.14-118.1 php5-suhosin-5.5.14-118.1 php5-suhosin-debuginfo-5.5.14-118.1 php5-sysvmsg-5.5.14-118.1 php5-sysvmsg-debuginfo-5.5.14-118.1 php5-sysvsem-5.5.14-118.1 php5-sysvsem-debuginfo-5.5.14-118.1 php5-sysvshm-5.5.14-118.1 php5-sysvshm-debuginfo-5.5.14-118.1 php5-tidy-5.5.14-118.1 php5-tidy-debuginfo-5.5.14-118.1 php5-tokenizer-5.5.14-118.1 php5-tokenizer-debuginfo-5.5.14-118.1 php5-wddx-5.5.14-118.1 php5-wddx-debuginfo-5.5.14-118.1 php5-xmlreader-5.5.14-118.1 php5-xmlreader-debuginfo-5.5.14-118.1 php5-xmlrpc-5.5.14-118.1 php5-xmlrpc-debuginfo-5.5.14-118.1 php5-xmlwriter-5.5.14-118.1 php5-xmlwriter-debuginfo-5.5.14-118.1 php5-xsl-5.5.14-118.1 php5-xsl-debuginfo-5.5.14-118.1 php5-zip-5.5.14-118.1 php5-zip-debuginfo-5.5.14-118.1 php5-zlib-5.5.14-118.1 php5-zlib-debuginfo-5.5.14-118.1 - openSUSE Leap 42.3 (noarch): php5-pear-5.5.14-118.1 References: https://www.suse.com/security/cve/CVE-2019-11034.html https://www.suse.com/security/cve/CVE-2019-11035.html https://www.suse.com/security/cve/CVE-2019-11036.html https://www.suse.com/security/cve/CVE-2019-9637.html https://www.suse.com/security/cve/CVE-2019-9638.html https://www.suse.com/security/cve/CVE-2019-9639.html https://www.suse.com/security/cve/CVE-2019-9640.html https://www.suse.com/security/cve/CVE-2019-9675.html https://bugzilla.suse.com/1128883 https://bugzilla.suse.com/1128886 https://bugzilla.suse.com/1128887 https://bugzilla.suse.com/1128889 https://bugzilla.suse.com/1128892 https://bugzilla.suse.com/1132837 https://bugzilla.suse.com/1132838 https://bugzilla.suse.com/1134322 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1499-1: important: Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork
by opensuse-security＠opensuse.org 03 Jun '19

03 Jun '19

openSUSE Security Update: Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1499-1 Rating: important References: #1114209 #1114832 #1118897 #1118898 #1118899 #1121397 #1121967 #1123013 #1128376 #1128746 #1134068 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 CVE-2019-5736 CVE-2019-6486 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has 6 fixes is now available. Description: This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues: Security issues fixed: - CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967). - CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013). - CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897). - CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898). - CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899). Other changes and bug fixes: - Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068). - Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068). - Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068). - docker-test: Improvements to test packaging (bsc#1128746). - Move daemon.json file to /etc/docker directory (bsc#1114832). - Revert golang(API) removal since it turns out this breaks >= requires in certain cases (bsc#1114209). - Fix go build failures (bsc#1121397). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1499=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): go-1.12-lp150.2.11.1 go-doc-1.12-lp150.2.11.1 - openSUSE Leap 15.0 (noarch): containerd-test-1.2.5-lp150.4.14.3 docker-bash-completion-18.09.6_ce-lp150.5.17.2 docker-runc-test-1.0.0rc6+gitr3804_2b18fe1d885e-lp150.5.21.2 docker-zsh-completion-18.09.6_ce-lp150.5.17.2 - openSUSE Leap 15.0 (x86_64): containerd-1.2.5-lp150.4.14.3 containerd-ctr-1.2.5-lp150.4.14.3 docker-18.09.6_ce-lp150.5.17.2 docker-debuginfo-18.09.6_ce-lp150.5.17.2 docker-debugsource-18.09.6_ce-lp150.5.17.2 docker-libnetwork-0.7.0.1+gitr2726_872f0a83c98a-lp150.3.14.1 docker-libnetwork-debuginfo-0.7.0.1+gitr2726_872f0a83c98a-lp150.3.14.1 docker-runc-1.0.0rc6+gitr3804_2b18fe1d885e-lp150.5.21.2 docker-runc-debuginfo-1.0.0rc6+gitr3804_2b18fe1d885e-lp150.5.21.2 docker-test-18.09.6_ce-lp150.5.17.2 docker-test-debuginfo-18.09.6_ce-lp150.5.17.2 go-race-1.12-lp150.2.11.1 go1.11-1.11.9-lp150.9.3 go1.11-doc-1.11.9-lp150.9.3 go1.11-race-1.11.9-lp150.9.3 go1.12-1.12.4-lp150.2.2 go1.12-doc-1.12.4-lp150.2.2 go1.12-race-1.12.4-lp150.2.2 golang-github-docker-libnetwork-0.7.0.1+gitr2726_872f0a83c98a-lp150.3.14.1 References: https://www.suse.com/security/cve/CVE-2018-16873.html https://www.suse.com/security/cve/CVE-2018-16874.html https://www.suse.com/security/cve/CVE-2018-16875.html https://www.suse.com/security/cve/CVE-2019-5736.html https://www.suse.com/security/cve/CVE-2019-6486.html https://bugzilla.suse.com/1114209 https://bugzilla.suse.com/1114832 https://bugzilla.suse.com/1118897 https://bugzilla.suse.com/1118898 https://bugzilla.suse.com/1118899 https://bugzilla.suse.com/1121397 https://bugzilla.suse.com/1121967 https://bugzilla.suse.com/1123013 https://bugzilla.suse.com/1128376 https://bugzilla.suse.com/1128746 https://bugzilla.suse.com/1134068 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1501-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 03 Jun '19

03 Jun '19

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1501-1 Rating: moderate References: #1132837 #1132838 #1134322 Cross-References: CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for php7 fixes the following issues: Security issues fixed: - CVE-2019-11034: Fixed a heap-buffer overflow in php_ifd_get32si() (bsc#1132838). - CVE-2019-11035: Fixed a heap-buffer overflow in exif_iif_add_value() (bsc#1132837). - CVE-2019-11036: Fixed buffer over-read in exif_process_IFD_TAG function leading to information disclosure (bsc#1134322). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1501=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_php7-7.0.7-61.1 apache2-mod_php7-debuginfo-7.0.7-61.1 php7-7.0.7-61.1 php7-bcmath-7.0.7-61.1 php7-bcmath-debuginfo-7.0.7-61.1 php7-bz2-7.0.7-61.1 php7-bz2-debuginfo-7.0.7-61.1 php7-calendar-7.0.7-61.1 php7-calendar-debuginfo-7.0.7-61.1 php7-ctype-7.0.7-61.1 php7-ctype-debuginfo-7.0.7-61.1 php7-curl-7.0.7-61.1 php7-curl-debuginfo-7.0.7-61.1 php7-dba-7.0.7-61.1 php7-dba-debuginfo-7.0.7-61.1 php7-debuginfo-7.0.7-61.1 php7-debugsource-7.0.7-61.1 php7-devel-7.0.7-61.1 php7-dom-7.0.7-61.1 php7-dom-debuginfo-7.0.7-61.1 php7-enchant-7.0.7-61.1 php7-enchant-debuginfo-7.0.7-61.1 php7-exif-7.0.7-61.1 php7-exif-debuginfo-7.0.7-61.1 php7-fastcgi-7.0.7-61.1 php7-fastcgi-debuginfo-7.0.7-61.1 php7-fileinfo-7.0.7-61.1 php7-fileinfo-debuginfo-7.0.7-61.1 php7-firebird-7.0.7-61.1 php7-firebird-debuginfo-7.0.7-61.1 php7-fpm-7.0.7-61.1 php7-fpm-debuginfo-7.0.7-61.1 php7-ftp-7.0.7-61.1 php7-ftp-debuginfo-7.0.7-61.1 php7-gd-7.0.7-61.1 php7-gd-debuginfo-7.0.7-61.1 php7-gettext-7.0.7-61.1 php7-gettext-debuginfo-7.0.7-61.1 php7-gmp-7.0.7-61.1 php7-gmp-debuginfo-7.0.7-61.1 php7-iconv-7.0.7-61.1 php7-iconv-debuginfo-7.0.7-61.1 php7-imap-7.0.7-61.1 php7-imap-debuginfo-7.0.7-61.1 php7-intl-7.0.7-61.1 php7-intl-debuginfo-7.0.7-61.1 php7-json-7.0.7-61.1 php7-json-debuginfo-7.0.7-61.1 php7-ldap-7.0.7-61.1 php7-ldap-debuginfo-7.0.7-61.1 php7-mbstring-7.0.7-61.1 php7-mbstring-debuginfo-7.0.7-61.1 php7-mcrypt-7.0.7-61.1 php7-mcrypt-debuginfo-7.0.7-61.1 php7-mysql-7.0.7-61.1 php7-mysql-debuginfo-7.0.7-61.1 php7-odbc-7.0.7-61.1 php7-odbc-debuginfo-7.0.7-61.1 php7-opcache-7.0.7-61.1 php7-opcache-debuginfo-7.0.7-61.1 php7-openssl-7.0.7-61.1 php7-openssl-debuginfo-7.0.7-61.1 php7-pcntl-7.0.7-61.1 php7-pcntl-debuginfo-7.0.7-61.1 php7-pdo-7.0.7-61.1 php7-pdo-debuginfo-7.0.7-61.1 php7-pgsql-7.0.7-61.1 php7-pgsql-debuginfo-7.0.7-61.1 php7-phar-7.0.7-61.1 php7-phar-debuginfo-7.0.7-61.1 php7-posix-7.0.7-61.1 php7-posix-debuginfo-7.0.7-61.1 php7-pspell-7.0.7-61.1 php7-pspell-debuginfo-7.0.7-61.1 php7-readline-7.0.7-61.1 php7-readline-debuginfo-7.0.7-61.1 php7-shmop-7.0.7-61.1 php7-shmop-debuginfo-7.0.7-61.1 php7-snmp-7.0.7-61.1 php7-snmp-debuginfo-7.0.7-61.1 php7-soap-7.0.7-61.1 php7-soap-debuginfo-7.0.7-61.1 php7-sockets-7.0.7-61.1 php7-sockets-debuginfo-7.0.7-61.1 php7-sqlite-7.0.7-61.1 php7-sqlite-debuginfo-7.0.7-61.1 php7-sysvmsg-7.0.7-61.1 php7-sysvmsg-debuginfo-7.0.7-61.1 php7-sysvsem-7.0.7-61.1 php7-sysvsem-debuginfo-7.0.7-61.1 php7-sysvshm-7.0.7-61.1 php7-sysvshm-debuginfo-7.0.7-61.1 php7-tidy-7.0.7-61.1 php7-tidy-debuginfo-7.0.7-61.1 php7-tokenizer-7.0.7-61.1 php7-tokenizer-debuginfo-7.0.7-61.1 php7-wddx-7.0.7-61.1 php7-wddx-debuginfo-7.0.7-61.1 php7-xmlreader-7.0.7-61.1 php7-xmlreader-debuginfo-7.0.7-61.1 php7-xmlrpc-7.0.7-61.1 php7-xmlrpc-debuginfo-7.0.7-61.1 php7-xmlwriter-7.0.7-61.1 php7-xmlwriter-debuginfo-7.0.7-61.1 php7-xsl-7.0.7-61.1 php7-xsl-debuginfo-7.0.7-61.1 php7-zip-7.0.7-61.1 php7-zip-debuginfo-7.0.7-61.1 php7-zlib-7.0.7-61.1 php7-zlib-debuginfo-7.0.7-61.1 - openSUSE Leap 42.3 (noarch): php7-pear-7.0.7-61.1 php7-pear-Archive_Tar-7.0.7-61.1 References: https://www.suse.com/security/cve/CVE-2019-11034.html https://www.suse.com/security/cve/CVE-2019-11035.html https://www.suse.com/security/cve/CVE-2019-11036.html https://bugzilla.suse.com/1132837 https://bugzilla.suse.com/1132838 https://bugzilla.suse.com/1134322 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1498-1: moderate: Security update for libtasn1
by opensuse-security＠opensuse.org 03 Jun '19

03 Jun '19

openSUSE Security Update: Security update for libtasn1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1498-1 Rating: moderate References: #1105435 Cross-References: CVE-2018-1000654 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libtasn1 fixes the following issues: Security issue fixed: - CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1498=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1498=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libtasn1-4.13-lp151.4.3.1 libtasn1-6-4.13-lp151.4.3.1 libtasn1-6-debuginfo-4.13-lp151.4.3.1 libtasn1-debuginfo-4.13-lp151.4.3.1 libtasn1-debugsource-4.13-lp151.4.3.1 libtasn1-devel-4.13-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): libtasn1-6-32bit-4.13-lp151.4.3.1 libtasn1-6-32bit-debuginfo-4.13-lp151.4.3.1 libtasn1-devel-32bit-4.13-lp151.4.3.1 - openSUSE Leap 15.0 (i586 x86_64): libtasn1-4.13-lp150.3.3.1 libtasn1-6-4.13-lp150.3.3.1 libtasn1-6-debuginfo-4.13-lp150.3.3.1 libtasn1-debuginfo-4.13-lp150.3.3.1 libtasn1-debugsource-4.13-lp150.3.3.1 libtasn1-devel-4.13-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): libtasn1-6-32bit-4.13-lp150.3.3.1 libtasn1-6-32bit-debuginfo-4.13-lp150.3.3.1 libtasn1-devel-32bit-4.13-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000654.html https://bugzilla.suse.com/1105435 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1492-1: important: Security update for curl
by opensuse-security＠opensuse.org 03 Jun '19

03 Jun '19

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1492-1 Rating: important References: #1135170 Cross-References: CVE-2019-5436 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for curl fixes the following issues: Security issue fixed: - CVE-2019-5436: Fixed a heap buffer overflow exists in tftp_receive_packet that receives data from a TFTP server (bsc#1135170). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1492=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): curl-7.37.0-51.1 curl-debuginfo-7.37.0-51.1 curl-debugsource-7.37.0-51.1 libcurl-devel-7.37.0-51.1 libcurl4-7.37.0-51.1 libcurl4-debuginfo-7.37.0-51.1 - openSUSE Leap 42.3 (x86_64): libcurl-devel-32bit-7.37.0-51.1 libcurl4-32bit-7.37.0-51.1 libcurl4-debuginfo-32bit-7.37.0-51.1 References: https://www.suse.com/security/cve/CVE-2019-5436.html https://bugzilla.suse.com/1135170 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1497-1: moderate: Security update for axis
by opensuse-security＠opensuse.org 03 Jun '19

03 Jun '19

openSUSE Security Update: Security update for axis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1497-1 Rating: moderate References: #1134598 Cross-References: CVE-2012-5784 CVE-2014-3596 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for axis fixes the following issues: Security issue fixed: - CVE-2012-5784, CVE-2014-3596: Fixed missing connection hostname check against X.509 certificate name (bsc#1134598). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1497=1 Package List: - openSUSE Leap 15.0 (noarch): axis-1.4-lp150.9.1 axis-manual-1.4-lp150.9.1 References: https://www.suse.com/security/cve/CVE-2012-5784.html https://www.suse.com/security/cve/CVE-2014-3596.html https://bugzilla.suse.com/1134598 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1491-1: moderate: Recommended update for GraphicsMagick
by opensuse-security＠opensuse.org 03 Jun '19

03 Jun '19

openSUSE Security Update: Recommended update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1491-1 Rating: moderate References: #1136183 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for GraphicsMagick fixes the following issues: Changes in GraphicsMagick: - disable also PCL decoding by default, as it is also passed through ghostscript (boo#1136183) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1491=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1491=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1491=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-141.1 GraphicsMagick-debuginfo-1.3.25-141.1 GraphicsMagick-debugsource-1.3.25-141.1 GraphicsMagick-devel-1.3.25-141.1 libGraphicsMagick++-Q16-12-1.3.25-141.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-141.1 libGraphicsMagick++-devel-1.3.25-141.1 libGraphicsMagick-Q16-3-1.3.25-141.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-141.1 libGraphicsMagick3-config-1.3.25-141.1 libGraphicsMagickWand-Q16-2-1.3.25-141.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-141.1 perl-GraphicsMagick-1.3.25-141.1 perl-GraphicsMagick-debuginfo-1.3.25-141.1 - openSUSE Leap 15.1 (x86_64): GraphicsMagick-1.3.29-lp151.4.3.1 GraphicsMagick-debuginfo-1.3.29-lp151.4.3.1 GraphicsMagick-debugsource-1.3.29-lp151.4.3.1 GraphicsMagick-devel-1.3.29-lp151.4.3.1 libGraphicsMagick++-Q16-12-1.3.29-lp151.4.3.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.29-lp151.4.3.1 libGraphicsMagick++-devel-1.3.29-lp151.4.3.1 libGraphicsMagick-Q16-3-1.3.29-lp151.4.3.1 libGraphicsMagick-Q16-3-debuginfo-1.3.29-lp151.4.3.1 libGraphicsMagick3-config-1.3.29-lp151.4.3.1 libGraphicsMagickWand-Q16-2-1.3.29-lp151.4.3.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.29-lp151.4.3.1 perl-GraphicsMagick-1.3.29-lp151.4.3.1 perl-GraphicsMagick-debuginfo-1.3.29-lp151.4.3.1 - openSUSE Leap 15.0 (x86_64): GraphicsMagick-1.3.29-lp150.3.31.1 GraphicsMagick-debuginfo-1.3.29-lp150.3.31.1 GraphicsMagick-debugsource-1.3.29-lp150.3.31.1 GraphicsMagick-devel-1.3.29-lp150.3.31.1 libGraphicsMagick++-Q16-12-1.3.29-lp150.3.31.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.29-lp150.3.31.1 libGraphicsMagick++-devel-1.3.29-lp150.3.31.1 libGraphicsMagick-Q16-3-1.3.29-lp150.3.31.1 libGraphicsMagick-Q16-3-debuginfo-1.3.29-lp150.3.31.1 libGraphicsMagick3-config-1.3.29-lp150.3.31.1 libGraphicsMagickWand-Q16-2-1.3.29-lp150.3.31.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.29-lp150.3.31.1 perl-GraphicsMagick-1.3.29-lp150.3.31.1 perl-GraphicsMagick-debuginfo-1.3.29-lp150.3.31.1 References: https://bugzilla.suse.com/1136183 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1494-1: moderate: Security update for NetworkManager
by opensuse-security＠opensuse.org 03 Jun '19

03 Jun '19

openSUSE Security Update: Security update for NetworkManager ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1494-1 Rating: moderate References: #1086263 Cross-References: CVE-2018-1000135 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for NetworkManager fixes the following issues: Following security issue was fixed: - CVE-2018-1000135: A potential leak of private DNS queries to other DNS servers could happen while on VPN (bsc#1086263, bgo#746422). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1494=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): NetworkManager-1.10.6-lp150.4.6.1 NetworkManager-debuginfo-1.10.6-lp150.4.6.1 NetworkManager-debugsource-1.10.6-lp150.4.6.1 NetworkManager-devel-1.10.6-lp150.4.6.1 libnm-glib-vpn1-1.10.6-lp150.4.6.1 libnm-glib-vpn1-debuginfo-1.10.6-lp150.4.6.1 libnm-glib4-1.10.6-lp150.4.6.1 libnm-glib4-debuginfo-1.10.6-lp150.4.6.1 libnm-util2-1.10.6-lp150.4.6.1 libnm-util2-debuginfo-1.10.6-lp150.4.6.1 libnm0-1.10.6-lp150.4.6.1 libnm0-debuginfo-1.10.6-lp150.4.6.1 typelib-1_0-NM-1_0-1.10.6-lp150.4.6.1 typelib-1_0-NMClient-1_0-1.10.6-lp150.4.6.1 typelib-1_0-NetworkManager-1_0-1.10.6-lp150.4.6.1 - openSUSE Leap 15.0 (x86_64): NetworkManager-devel-32bit-1.10.6-lp150.4.6.1 libnm-glib-vpn1-32bit-1.10.6-lp150.4.6.1 libnm-glib-vpn1-32bit-debuginfo-1.10.6-lp150.4.6.1 libnm-glib4-32bit-1.10.6-lp150.4.6.1 libnm-glib4-32bit-debuginfo-1.10.6-lp150.4.6.1 libnm-util2-32bit-1.10.6-lp150.4.6.1 libnm-util2-32bit-debuginfo-1.10.6-lp150.4.6.1 - openSUSE Leap 15.0 (noarch): NetworkManager-branding-upstream-1.10.6-lp150.4.6.1 NetworkManager-lang-1.10.6-lp150.4.6.1 References: https://www.suse.com/security/cve/CVE-2018-1000135.html https://bugzilla.suse.com/1086263 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1495-1: important: Recommended update for sles12sp3-docker-image, sles12sp4-image, system-user-root
by opensuse-security＠opensuse.org 03 Jun '19

03 Jun '19

openSUSE Security Update: Recommended update for sles12sp3-docker-image, sles12sp4-image, system-user-root ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1495-1 Rating: important References: #1134524 Cross-References: CVE-2019-5021 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for sles12sp3-docker-image, sles12sp4-image, system-user-root fixes the following issues: - CVE-2019-5021: Include an invalidated root password by default, not an empty one (bsc#1134524) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1495=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1495=1 Package List: - openSUSE Leap 15.1 (noarch): system-user-root-20190513-lp151.3.3.1 - openSUSE Leap 15.0 (noarch): system-user-root-20190513-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-5021.html https://bugzilla.suse.com/1134524 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1488-1: important: Security update for chromium
by opensuse-security＠opensuse.org 03 Jun '19

03 Jun '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1488-1 Rating: important References: #1134218 Cross-References: CVE-2019-5824 CVE-2019-5827 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to 74.0.3729.157: - Various security fixes from internal audits, fuzzing and other initiatives Includes security fixes from 74.0.3729.131 (boo#1134218): - CVE-2019-5827: Out-of-bounds access in SQLite - CVE-2019-5824: Parameter passing error in media player This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1488=1 Package List: - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-74.0.3729.157-bp150.210.1 chromium-74.0.3729.157-bp150.210.1 References: https://www.suse.com/security/cve/CVE-2019-5824.html https://www.suse.com/security/cve/CVE-2019-5827.html https://bugzilla.suse.com/1134218 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0