July 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:1796-1: important: Security update for neovim
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for neovim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1796-1 Rating: important References: #1137443 Cross-References: CVE-2019-12735 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for neovim fixes the following issues: neovim was updated to version 0.3.7: * CVE-2019-12735: source should check sandbox (boo#1137443) * genappimage.sh: migrate to linuxdeploy Version Update to version 0.3.5: * options: properly reset directories on 'autochdir' * Remove MSVC optimization workaround for SHM_ALL * Make SHM_ALL to a variable instead of a compound literal #define * doc: mention "pynvim" module rename * screen: don't crash when drawing popupmenu with 'rightleft' option * look-behind match may use the wrong line number * :terminal : set topline based on window height * :recover : Fix crash on non-existent *.swp Version Update to version 0.3.4: * test: add tests for conceal cursor movement * display: unify ursorline and concealcursor redraw logic Version Update to version 0.3.3: * health/provider: Check for available pynvim when neovim mod is missing * python#CheckForModule: Use the given module string instead of hard-coding pynvim * (health.provider)/python: Import the neovim, rather than pynvim, module * TUI: Konsole DECSCUSR fixup Version Update to version 0.3.2:- * Features - clipboard: support Custom VimL functions (#9304) - win/TUI: improve terminal/console support (#9401) - startup: Use $XDG_CONFIG_DIRS/nvim/sysinit.vim if exists (#9077) - support mapping in more places (#9299) - diff/highlight: show underline for low-priority CursorLine (#9028) - signs: Add "nuhml" argument (#9113) - clipboard: support Wayland (#9230) - TUI: add support for undercurl and underline color (#9052) - man.vim: soft (dynamic) wrap (#9023) * API - API: implement object namespaces (#6920) - API: implement nvim_win_set_buf() (#9100) - API: virtual text annotations (nvim_buf_set_virtual_text) (#8180) - API: add nvim_buf_is_loaded() (#8660) - API: nvm_buf_get_offset_for_line (#8221) - API/UI: ext_newgrid, ext_histate (#8221) * UI - TUI: use BCE again more often (smoother resize) (#8806) - screen: add missing status redraw when redraw_later(CLEAR) was used (#9315) - TUI: clip invalid regions on resize (#8779) - TUI: improvements for scrolling and clearing (#9193) - TUI: disable clearing almost everywhere (#9143) - TUI: always use safe cursor movement after resize (#9079) - ui_options: also send when starting or from OptionSet (#9211) - TUI: Avoid reset_color_cursor_color in old VTE (#9191) - Don't erase screen on :hi Normal during startup (#9021) - TUI: Hint wrapped lines to terminals (#8915) * FIXES - RPC: turn errors from async calls into notifications - TUI: Restore terminal title via "title stacking" (#9407) - genappimage: Unset $ARGV0 at invocation (#9376) - TUI: Konsole 18.07.70 supports DECSCUSR (#9364) - provider: improve error message (#9344) - runtime/syntax: Fix highlighting of autogroup contents (#9328) - VimL/confirm(): Show dialog even if :silent (#9297) - clipboard: prefer xclip (#9302) - provider/nodejs: fix npm, yarn detection - channel: avoid buffering output when only terminal is active (#9218) - ruby: detect rbenv shims for other versions (#8733) - third party/unibilium: Fix parsing of extended capabilitiy entries (#9123) - jobstart(): Fix hang on non-executable cwd (#9204) - provide/nodejs: Simultaneously query npm and yarn (#9054) - undo: Fix infinite loop if undo_read_byte returns EOF (#2880) - 'swapfile: always show dialog' (#9034) - Add to the system-wide configuration file extension of runtimepath by /usr/share/vim/site, so that neovim uses other Vim plugins installed from packages. - Add /usr/share/vim/site tree of directories to be owned by neovim as well. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1796=1 Package List: - openSUSE Backports SLE-15 (noarch): neovim-lang-0.3.7-bp150.2.9.1 - openSUSE Backports SLE-15 (x86_64): neovim-0.3.7-bp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2019-12735.html https://bugzilla.suse.com/1137443 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1792-1: moderate: Security update for libgcrypt
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for libgcrypt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1792-1 Rating: moderate References: #1097073 #1125740 #1138939 Cross-References: CVE-2019-12904 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for libgcrypt fixes the following issues: Security issues fixed: - CVE-2019-12904: The C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) (bsc#1138939) Other bugfixes: - Don't run full FIPS self-tests from constructor (bsc#1097073) - Skip all the self-tests except for binary integrity when called from the constructor (bsc#1097073) - Enforce the minimal RSA keygen size in fips mode (bsc#1125740) - avoid executing some tests twice. - Fixed a race condition in initialization. - Fixed env-script-interpreter in cavs_driver.pl - Fixed redundant fips tests in some situations causing failure to boot in fips mode. (bsc#1097073) This helps during booting of the system in FIPS mode with insufficient entropy. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1792=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libgcrypt-cavs-1.8.2-lp150.5.10.1 libgcrypt-cavs-debuginfo-1.8.2-lp150.5.10.1 libgcrypt-debugsource-1.8.2-lp150.5.10.1 libgcrypt-devel-1.8.2-lp150.5.10.1 libgcrypt-devel-debuginfo-1.8.2-lp150.5.10.1 libgcrypt20-1.8.2-lp150.5.10.1 libgcrypt20-debuginfo-1.8.2-lp150.5.10.1 libgcrypt20-hmac-1.8.2-lp150.5.10.1 - openSUSE Leap 15.0 (x86_64): libgcrypt-devel-32bit-1.8.2-lp150.5.10.1 libgcrypt-devel-32bit-debuginfo-1.8.2-lp150.5.10.1 libgcrypt20-32bit-1.8.2-lp150.5.10.1 libgcrypt20-32bit-debuginfo-1.8.2-lp150.5.10.1 libgcrypt20-hmac-32bit-1.8.2-lp150.5.10.1 References: https://www.suse.com/security/cve/CVE-2019-12904.html https://bugzilla.suse.com/1097073 https://bugzilla.suse.com/1125740 https://bugzilla.suse.com/1138939 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1794-1: moderate: Security update for mumble
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for mumble ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1794-1 Rating: moderate References: #1123334 Cross-References: CVE-2018-20743 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mumble fixes the following issues: CVE-2018-20743: murmur mishandled multiple concurrent requests that were persisted in the database, which allowed remote attackers to cause a denial of service (daemon hang or crash) via a message flood. (boo#1123334) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1794=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1794=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1794=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1794=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): mumble-1.2.19-lp151.4.6.1 mumble-debuginfo-1.2.19-lp151.4.6.1 mumble-debugsource-1.2.19-lp151.4.6.1 mumble-server-1.2.19-lp151.4.6.1 mumble-server-debuginfo-1.2.19-lp151.4.6.1 - openSUSE Leap 15.1 (x86_64): mumble-32bit-1.2.19-lp151.4.6.1 mumble-32bit-debuginfo-1.2.19-lp151.4.6.1 - openSUSE Leap 15.0 (i586 x86_64): mumble-1.2.19-lp150.3.3.1 mumble-debuginfo-1.2.19-lp150.3.3.1 mumble-debugsource-1.2.19-lp150.3.3.1 mumble-server-1.2.19-lp150.3.3.1 mumble-server-debuginfo-1.2.19-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): mumble-32bit-1.2.19-lp150.3.3.1 mumble-32bit-debuginfo-1.2.19-lp150.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): mumble-1.2.19-bp150.3.3.1 mumble-server-1.2.19-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): mumble-64bit-1.2.19-bp150.3.3.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (ppc64le s390x x86_64): mumble-1.2.19-9.1 mumble-server-1.2.19-9.1 References: https://www.suse.com/security/cve/CVE-2018-20743.html https://bugzilla.suse.com/1123334 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1791-1: moderate: Security update for libsass
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for libsass ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1791-1 Rating: moderate References: #1096894 #1118301 #1118346 #1118348 #1118349 #1118351 #1119789 #1121943 #1121944 #1121945 #1133200 #1133201 Cross-References: CVE-2018-11499 CVE-2018-19797 CVE-2018-19827 CVE-2018-19837 CVE-2018-19838 CVE-2018-19839 CVE-2018-20190 CVE-2018-20821 CVE-2018-20822 CVE-2019-6283 CVE-2019-6284 CVE-2019-6286 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for libsass to version 3.6.1 fixes the following issues: Security issues fixed: - CVE-2019-6283: Fixed heap-buffer-overflow in Sass::Prelexer::parenthese_scope(char const*) (boo#1121943). - CVE-2019-6284: Fixed heap-based buffer over-read exists in Sass:Prelexer:alternatives (boo#1121944). - CVE-2019-6286: Fixed heap-based buffer over-read exists in Sass:Prelexer:skip_over_scopes (boo#1121945). - CVE-2018-11499: Fixed use-after-free vulnerability in sass_context.cpp:handle_error (boo#1096894). - CVE-2018-19797: Disallowed parent selector in selector_fns arguments (boo#1118301). - CVE-2018-19827: Fixed use-after-free vulnerability exists in the SharedPtr class (boo#1118346). - CVE-2018-19837: Fixed stack overflow in Eval::operator() (boo#1118348). - CVE-2018-19838: Fixed stack-overflow at IMPLEMENT_AST_OPERATORS expansion (boo#1118349). - CVE-2018-19839: Fixed buffer-overflow (OOB read) against some invalid input (boo#1118351). - CVE-2018-20190: Fixed Null pointer dereference in Sass::Eval::operator()(Sass::Supports_Operator*) (boo#1119789). - CVE-2018-20821: Fixed uncontrolled recursion in Sass:Parser:parse_css_variable_value (boo#1133200). - CVE-2018-20822: Fixed stack-overflow at Sass::Inspect::operator() (boo#1133201). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1791=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1791=1 Package List: - openSUSE Leap 15.1 (x86_64): libsass-3_6_1-1-3.6.1-lp151.3.3.1 libsass-3_6_1-1-debuginfo-3.6.1-lp151.3.3.1 libsass-debugsource-3.6.1-lp151.3.3.1 libsass-devel-3.6.1-lp151.3.3.1 - openSUSE Leap 15.0 (x86_64): libsass-3_6_1-1-3.6.1-lp150.2.3.1 libsass-3_6_1-1-debuginfo-3.6.1-lp150.2.3.1 libsass-debugsource-3.6.1-lp150.2.3.1 libsass-devel-3.6.1-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-11499.html https://www.suse.com/security/cve/CVE-2018-19797.html https://www.suse.com/security/cve/CVE-2018-19827.html https://www.suse.com/security/cve/CVE-2018-19837.html https://www.suse.com/security/cve/CVE-2018-19838.html https://www.suse.com/security/cve/CVE-2018-19839.html https://www.suse.com/security/cve/CVE-2018-20190.html https://www.suse.com/security/cve/CVE-2018-20821.html https://www.suse.com/security/cve/CVE-2018-20822.html https://www.suse.com/security/cve/CVE-2019-6283.html https://www.suse.com/security/cve/CVE-2019-6284.html https://www.suse.com/security/cve/CVE-2019-6286.html https://bugzilla.suse.com/1096894 https://bugzilla.suse.com/1118301 https://bugzilla.suse.com/1118346 https://bugzilla.suse.com/1118348 https://bugzilla.suse.com/1118349 https://bugzilla.suse.com/1118351 https://bugzilla.suse.com/1119789 https://bugzilla.suse.com/1121943 https://bugzilla.suse.com/1121944 https://bugzilla.suse.com/1121945 https://bugzilla.suse.com/1133200 https://bugzilla.suse.com/1133201 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1793-1: moderate: Security update for teeworlds
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for teeworlds ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1793-1 Rating: moderate References: #1112910 #1131729 Cross-References: CVE-2018-18541 CVE-2019-10877 CVE-2019-10878 CVE-2019-10879 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for teeworlds fixes the following issues: - CVE-2019-10879: An integer overflow in CDataFileReader::Open() could have lead to a buffer overflow and possibly remote code execution, because size-related multiplications were mishandled. (boo#1131729) - CVE-2019-10878: A failed bounds check in CDataFileReader::GetData() and CDataFileReader::ReplaceData() and related functions could have lead to an arbitrary free and out-of-bounds pointer write, possibly resulting in remote code execution. - CVE-2019-10877: An integer overflow in CMap::Load() could have lead to a buffer overflow, because multiplication of width and height were mishandled. - CVE-2018-18541: Connection packets could have been forged. There was no challenge-response involved in the connection build up. A remote attacker could have sent connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download packets. (boo#1112910) - Update to version 0.7.3.1 * Colorful gametype and level icons in the browser instead of grayscale. * Add an option to use raw mouse inputs, revert to (0.6) relative mode by default. * Demo list marker indicator. * Restore ingame Player and Tee menus, add a warning that a reconnect is needed. * Emotes can now be cancelled by releasing the mouse in the middle of the circle. * Improve add friend text. * Add a confirmation for removing a filter * Add a "click a player to follow" hint * Also hint players which key they should press to set themselves ready. * fixed using correct array measurements when placing egg doodads * fixed demo recorder downloaded maps using the sha256 hash * show correct game release version in the start menu and console * Fix platform-specific client libraries for Linux * advanced scoreboard with game statistics * joystick support (experimental!) * copy paste (one-way) * bot cosmetics (a visual difference between players and NPCs) * chat commands (type / in chat) * players can change skin without leaving the server (again) * live automapper and complete rules for 0.7 tilesets * audio toggling HUD * an Easter surprise... * new gametypes: "last man standing" (LMS) and "last team standing" (LTS). survive by your own or as a team with limited weaponry * 64 players support. official gametypes are still restricted to 16 players maximum but allow more spectators * new skin system. build your own skins based on a variety of provided parts * enhanced security. all communications require a handshake and use a token to counter spoofing and reflection attacks * new maps: ctf8, dm3, lms1. Click to discover them! * animated background menu map: jungle, heavens (day/night themes, customisable in the map editor) * new design for the menus: added start menus, reworked server browser, settings * customisable gametype icons (browser). make your own! * chat overhaul, whispers (private messages) * composed binds (ctrl+, shift+, alt+) * scoreboard remodelled, now shows kills/deaths * demo markers * master server list cache (in case the masters are unreachable) * input separated from rendering (optimisation) * upgrade to SDL2. support for multiple monitors, non-english keyboards, and more * broadcasts overhaul, optional colours support * ready system, for competitive settings * server difficulty setting (casual, competitive, normal), shown in the browser * spectator mode improvements: follow flags, click on players * bot flags for modified servers: indicate NPCs, can be filtered out in the server browser * sharper graphics all around (no more tileset_borderfix and dilate) * refreshed the HUD, ninja cooldown, new mouse cursor * mapres update (higher resolution, fixes...) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1793=1 Package List: - openSUSE Leap 15.1 (x86_64): teeworlds-0.7.3.1-lp151.2.3.1 teeworlds-debuginfo-0.7.3.1-lp151.2.3.1 teeworlds-debugsource-0.7.3.1-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-18541.html https://www.suse.com/security/cve/CVE-2019-10877.html https://www.suse.com/security/cve/CVE-2019-10878.html https://www.suse.com/security/cve/CVE-2019-10879.html https://bugzilla.suse.com/1112910 https://bugzilla.suse.com/1131729 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1794-1: moderate: Security update for mumble
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for mumble ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1794-1 Rating: moderate References: #1123334 Cross-References: CVE-2018-20743 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mumble fixes the following issues: CVE-2018-20743: murmur mishandled multiple concurrent requests that were persisted in the database, which allowed remote attackers to cause a denial of service (daemon hang or crash) via a message flood. (boo#1123334) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1794=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1794=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1794=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): mumble-1.2.19-lp151.4.6.1 mumble-debuginfo-1.2.19-lp151.4.6.1 mumble-debugsource-1.2.19-lp151.4.6.1 mumble-server-1.2.19-lp151.4.6.1 mumble-server-debuginfo-1.2.19-lp151.4.6.1 - openSUSE Leap 15.1 (x86_64): mumble-32bit-1.2.19-lp151.4.6.1 mumble-32bit-debuginfo-1.2.19-lp151.4.6.1 - openSUSE Leap 15.0 (i586 x86_64): mumble-1.2.19-lp150.3.3.1 mumble-debuginfo-1.2.19-lp150.3.3.1 mumble-debugsource-1.2.19-lp150.3.3.1 mumble-server-1.2.19-lp150.3.3.1 mumble-server-debuginfo-1.2.19-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): mumble-32bit-1.2.19-lp150.3.3.1 mumble-32bit-debuginfo-1.2.19-lp150.3.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): mumble-1.2.19-bp150.3.3.1 mumble-server-1.2.19-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): mumble-64bit-1.2.19-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-20743.html https://bugzilla.suse.com/1123334 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1797-1: moderate: Security update for live555
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for live555 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1797-1 Rating: moderate References: #1121995 #1124159 #1127341 Cross-References: CVE-2019-7314 CVE-2019-9215 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for live555 fixes the following issues: - CVE-2019-9215: Malformed headers could have lead to invalid memory access in the parseAuthorizationHeader function. (boo#1127341) - CVE-2019-7314: Mishandled termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up could have lead to a Use-After-Free error causing the RTSP server to crash or possibly have unspecified other impact. (boo#1124159) - Update to version 2019.06.28, - Convert to dynamic libraries (boo#1121995): + Use make ilinux-with-shared-libraries: build the dynamic libs instead of the static one. + Use make install instead of a manual file copy script: this also reveals that we missed quite a bit of code to be installed before. + Split out shared library packages according the SLPP. - Use FAT LTO objects in order to provide proper static library. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1797=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1797=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1797=1 Package List: - openSUSE Leap 15.1 (x86_64): libBasicUsageEnvironment1-2019.06.28-lp151.2.3.1 libBasicUsageEnvironment1-debuginfo-2019.06.28-lp151.2.3.1 libUsageEnvironment3-2019.06.28-lp151.2.3.1 libUsageEnvironment3-debuginfo-2019.06.28-lp151.2.3.1 libgroupsock8-2019.06.28-lp151.2.3.1 libgroupsock8-debuginfo-2019.06.28-lp151.2.3.1 libliveMedia66-2019.06.28-lp151.2.3.1 libliveMedia66-debuginfo-2019.06.28-lp151.2.3.1 live555-2019.06.28-lp151.2.3.1 live555-debuginfo-2019.06.28-lp151.2.3.1 live555-debugsource-2019.06.28-lp151.2.3.1 live555-devel-2019.06.28-lp151.2.3.1 - openSUSE Leap 15.0 (x86_64): libBasicUsageEnvironment1-2019.06.28-lp150.12.1 libBasicUsageEnvironment1-debuginfo-2019.06.28-lp150.12.1 libUsageEnvironment3-2019.06.28-lp150.12.1 libUsageEnvironment3-debuginfo-2019.06.28-lp150.12.1 libgroupsock8-2019.06.28-lp150.12.1 libgroupsock8-debuginfo-2019.06.28-lp150.12.1 libliveMedia66-2019.06.28-lp150.12.1 libliveMedia66-debuginfo-2019.06.28-lp150.12.1 live555-2019.06.28-lp150.12.1 live555-debuginfo-2019.06.28-lp150.12.1 live555-debugsource-2019.06.28-lp150.12.1 live555-devel-2019.06.28-lp150.12.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libBasicUsageEnvironment1-2019.06.28-bp150.12.1 libUsageEnvironment3-2019.06.28-bp150.12.1 libgroupsock8-2019.06.28-bp150.12.1 libliveMedia66-2019.06.28-bp150.12.1 live555-2019.06.28-bp150.12.1 live555-devel-2019.06.28-bp150.12.1 References: https://www.suse.com/security/cve/CVE-2019-7314.html https://www.suse.com/security/cve/CVE-2019-9215.html https://bugzilla.suse.com/1121995 https://bugzilla.suse.com/1124159 https://bugzilla.suse.com/1127341 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1795-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 23 Jul '19

23 Jul '19

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1795-1 Rating: moderate References: #1138425 #1138464 Cross-References: CVE-2019-11597 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2019-11597: Fixed a heap-based buffer over-read in the WriteTIFFImage() (bsc#1138464). - Fixed a file content disclosure via SVG and WMF decoding (bsc#1138425). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1795=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1795=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ImageMagick-7.0.7.34-lp151.7.6.1 ImageMagick-config-7-SUSE-7.0.7.34-lp151.7.6.1 ImageMagick-config-7-upstream-7.0.7.34-lp151.7.6.1 ImageMagick-debuginfo-7.0.7.34-lp151.7.6.1 ImageMagick-debugsource-7.0.7.34-lp151.7.6.1 ImageMagick-devel-7.0.7.34-lp151.7.6.1 ImageMagick-extra-7.0.7.34-lp151.7.6.1 ImageMagick-extra-debuginfo-7.0.7.34-lp151.7.6.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp151.7.6.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp151.7.6.1 libMagick++-devel-7.0.7.34-lp151.7.6.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp151.7.6.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp151.7.6.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp151.7.6.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp151.7.6.1 perl-PerlMagick-7.0.7.34-lp151.7.6.1 perl-PerlMagick-debuginfo-7.0.7.34-lp151.7.6.1 - openSUSE Leap 15.1 (noarch): ImageMagick-doc-7.0.7.34-lp151.7.6.1 - openSUSE Leap 15.1 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp151.7.6.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp151.7.6.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp151.7.6.1 libMagick++-devel-32bit-7.0.7.34-lp151.7.6.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp151.7.6.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp151.7.6.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp151.7.6.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp151.7.6.1 - openSUSE Leap 15.0 (i586 x86_64): ImageMagick-7.0.7.34-lp150.2.35.1 ImageMagick-config-7-SUSE-7.0.7.34-lp150.2.35.1 ImageMagick-config-7-upstream-7.0.7.34-lp150.2.35.1 ImageMagick-debuginfo-7.0.7.34-lp150.2.35.1 ImageMagick-debugsource-7.0.7.34-lp150.2.35.1 ImageMagick-devel-7.0.7.34-lp150.2.35.1 ImageMagick-extra-7.0.7.34-lp150.2.35.1 ImageMagick-extra-debuginfo-7.0.7.34-lp150.2.35.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp150.2.35.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp150.2.35.1 libMagick++-devel-7.0.7.34-lp150.2.35.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp150.2.35.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.35.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp150.2.35.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.35.1 perl-PerlMagick-7.0.7.34-lp150.2.35.1 perl-PerlMagick-debuginfo-7.0.7.34-lp150.2.35.1 - openSUSE Leap 15.0 (noarch): ImageMagick-doc-7.0.7.34-lp150.2.35.1 - openSUSE Leap 15.0 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp150.2.35.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp150.2.35.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp150.2.35.1 libMagick++-devel-32bit-7.0.7.34-lp150.2.35.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.35.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.35.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.35.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.35.1 References: https://www.suse.com/security/cve/CVE-2019-11597.html https://bugzilla.suse.com/1138425 https://bugzilla.suse.com/1138464 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1785-1: moderate: Security update for python-Twisted
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for python-Twisted ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1785-1 Rating: moderate References: #1137825 Cross-References: CVE-2019-12387 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Twisted fixes the following issue: Security issue fixed: - CVE-2019-12387: Fixed an improper sanitization of URIs or HTTP which could have allowed attackers to perfrom CRLF attacks (bsc#1137825). This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1785=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): python-Twisted-doc-17.9.0-bp150.4.3.1 python2-Twisted-17.9.0-bp150.4.3.1 python3-Twisted-17.9.0-bp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-12387.html https://bugzilla.suse.com/1137825 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1782-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 21 Jul '19

21 Jul '19

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1782-1 Rating: important References: #1140868 Cross-References: CVE-2019-11709 CVE-2019-11711 CVE-2019-11712 CVE-2019-11713 CVE-2019-11715 CVE-2019-11717 CVE-2019-11719 CVE-2019-11729 CVE-2019-11730 CVE-2019-9811 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for MozillaFirefox, mozilla-nss fixes the following issues: MozillaFirefox to version ESR 60.8: - CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868). - CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868). - CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868). - CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868). - CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868). - CVE-2019-11715: HTML parsing error can contribute to content XSS (bsc#1140868). - CVE-2019-11717: Caret character improperly escaped in origins (bsc#1140868). - CVE-2019-11719: Out-of-bounds read when importing curve25519 private key (bsc#1140868). - CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin (bsc#1140868). - CVE-2019-11709: Multiple Memory safety bugs fixed (bsc#1140868). mozilla-nss to version 3.44.1: * Added IPSEC IKE support to softoken * Many new FIPS test cases This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1782=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libfreebl3-3.44.1-lp151.2.3.1 libfreebl3-debuginfo-3.44.1-lp151.2.3.1 libfreebl3-hmac-3.44.1-lp151.2.3.1 libsoftokn3-3.44.1-lp151.2.3.1 libsoftokn3-debuginfo-3.44.1-lp151.2.3.1 libsoftokn3-hmac-3.44.1-lp151.2.3.1 mozilla-nss-3.44.1-lp151.2.3.1 mozilla-nss-certs-3.44.1-lp151.2.3.1 mozilla-nss-certs-debuginfo-3.44.1-lp151.2.3.1 mozilla-nss-debuginfo-3.44.1-lp151.2.3.1 mozilla-nss-debugsource-3.44.1-lp151.2.3.1 mozilla-nss-devel-3.44.1-lp151.2.3.1 mozilla-nss-sysinit-3.44.1-lp151.2.3.1 mozilla-nss-sysinit-debuginfo-3.44.1-lp151.2.3.1 mozilla-nss-tools-3.44.1-lp151.2.3.1 mozilla-nss-tools-debuginfo-3.44.1-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): MozillaFirefox-60.8.0-lp151.2.10.1 MozillaFirefox-branding-upstream-60.8.0-lp151.2.10.1 MozillaFirefox-buildsymbols-60.8.0-lp151.2.10.1 MozillaFirefox-debuginfo-60.8.0-lp151.2.10.1 MozillaFirefox-debugsource-60.8.0-lp151.2.10.1 MozillaFirefox-devel-60.8.0-lp151.2.10.1 MozillaFirefox-translations-common-60.8.0-lp151.2.10.1 MozillaFirefox-translations-other-60.8.0-lp151.2.10.1 libfreebl3-32bit-3.44.1-lp151.2.3.1 libfreebl3-32bit-debuginfo-3.44.1-lp151.2.3.1 libfreebl3-hmac-32bit-3.44.1-lp151.2.3.1 libsoftokn3-32bit-3.44.1-lp151.2.3.1 libsoftokn3-32bit-debuginfo-3.44.1-lp151.2.3.1 libsoftokn3-hmac-32bit-3.44.1-lp151.2.3.1 mozilla-nss-32bit-3.44.1-lp151.2.3.1 mozilla-nss-32bit-debuginfo-3.44.1-lp151.2.3.1 mozilla-nss-certs-32bit-3.44.1-lp151.2.3.1 mozilla-nss-certs-32bit-debuginfo-3.44.1-lp151.2.3.1 mozilla-nss-sysinit-32bit-3.44.1-lp151.2.3.1 mozilla-nss-sysinit-32bit-debuginfo-3.44.1-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-11709.html https://www.suse.com/security/cve/CVE-2019-11711.html https://www.suse.com/security/cve/CVE-2019-11712.html https://www.suse.com/security/cve/CVE-2019-11713.html https://www.suse.com/security/cve/CVE-2019-11715.html https://www.suse.com/security/cve/CVE-2019-11717.html https://www.suse.com/security/cve/CVE-2019-11719.html https://www.suse.com/security/cve/CVE-2019-11729.html https://www.suse.com/security/cve/CVE-2019-11730.html https://www.suse.com/security/cve/CVE-2019-9811.html https://bugzilla.suse.com/1140868 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0