August 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:2040-1: moderate: Security update for libmirage
by opensuse-security＠opensuse.org 31 Aug '19

31 Aug '19

openSUSE Security Update: Security update for libmirage ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2040-1 Rating: moderate References: #1148087 Cross-References: CVE-2019-15540 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libmirage fixes the following issues: CVE-2019-15540: The CSO filter in libMirage in CDemu did not validate the part size, triggering a heap-based buffer overflow that could lead to root access by a local user. [boo#1148087] - Update to new upstream release 3.2.2 * ISO parser: fixed ISO9660/UDF pattern search for sector sizes 2332 and 2336. * ISO parser: added support for Nintendo GameCube and Wii ISO images. * Extended medium type guess to distinguish between DVD and BluRay images based on length. * Removed fabrication of disc structures from the library (moved to CDEmu daemon). * MDS parser: cleanup of disc structure parsing, fixed the incorrectly set structure sizes. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2040=1 Package List: - openSUSE Leap 15.0 (noarch): libmirage-data-3.2.2-lp150.2.3.1 libmirage-lang-3.2.2-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libmirage-3_2-3.2.2-lp150.2.3.1 libmirage-3_2-debuginfo-3.2.2-lp150.2.3.1 libmirage-debuginfo-3.2.2-lp150.2.3.1 libmirage-debugsource-3.2.2-lp150.2.3.1 libmirage-devel-3.2.2-lp150.2.3.1 libmirage11-3.2.2-lp150.2.3.1 libmirage11-debuginfo-3.2.2-lp150.2.3.1 typelib-1_0-libmirage-3_2-3.2.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-15540.html https://bugzilla.suse.com/1148087 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2038-1: moderate: Security update for flatpak
by opensuse-security＠opensuse.org 31 Aug '19

31 Aug '19

openSUSE Security Update: Security update for flatpak ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2038-1 Rating: moderate References: #1125431 #1133041 #1133043 Cross-References: CVE-2019-11460 CVE-2019-11461 CVE-2019-8308 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for flatpak fixes the following issues: Security issues fixed: - CVE-2019-8308: Fixed a potential sandbox escape via /proc (bsc#1125431). - CVE-2019-11460: Fixed a compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl (bsc#1133043). - CVE-2019-11461: Fixed a compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl (bsc#1133041). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2038=1 Package List: - openSUSE Leap 15.0 (x86_64): flatpak-0.10.4-lp150.8.1 flatpak-debuginfo-0.10.4-lp150.8.1 flatpak-debugsource-0.10.4-lp150.8.1 flatpak-devel-0.10.4-lp150.8.1 libflatpak0-0.10.4-lp150.8.1 libflatpak0-debuginfo-0.10.4-lp150.8.1 typelib-1_0-Flatpak-1_0-0.10.4-lp150.8.1 References: https://www.suse.com/security/cve/CVE-2019-11460.html https://www.suse.com/security/cve/CVE-2019-11461.html https://www.suse.com/security/cve/CVE-2019-8308.html https://bugzilla.suse.com/1125431 https://bugzilla.suse.com/1133041 https://bugzilla.suse.com/1133043 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2039-1: important: Security update for python-SQLAlchemy
by opensuse-security＠opensuse.org 31 Aug '19

31 Aug '19

openSUSE Security Update: Security update for python-SQLAlchemy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2039-1 Rating: important References: #1124593 Cross-References: CVE-2019-7164 CVE-2019-7548 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python-SQLAlchemy fixes the following issues: Security issues fixed: - CVE-2019-7164: Fixed SQL Injection via the order_by parameter (bsc#1124593). - CVE-2019-7548: Fixed SQL Injection via the group_by parameter (bsc#1124593). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2039=1 Package List: - openSUSE Leap 15.0 (noarch): python-SQLAlchemy-doc-1.2.7-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): python-SQLAlchemy-debuginfo-1.2.7-lp150.2.3.1 python-SQLAlchemy-debugsource-1.2.7-lp150.2.3.1 python2-SQLAlchemy-1.2.7-lp150.2.3.1 python2-SQLAlchemy-debuginfo-1.2.7-lp150.2.3.1 python3-SQLAlchemy-1.2.7-lp150.2.3.1 python3-SQLAlchemy-debuginfo-1.2.7-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-7164.html https://www.suse.com/security/cve/CVE-2019-7548.html https://bugzilla.suse.com/1124593 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2033-1: moderate: Security update for libmirage
by opensuse-security＠opensuse.org 31 Aug '19

31 Aug '19

openSUSE Security Update: Security update for libmirage ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2033-1 Rating: moderate References: #1148087 Cross-References: CVE-2019-15540 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libmirage fixes the following issues: CVE-2019-15540: The CSO filter in libMirage in CDemu did not validate the part size, triggering a heap-based buffer overflow that could lead to root access by a local user. [boo#1148087] - Update to new upstream release 3.2.2 * ISO parser: fixed ISO9660/UDF pattern search for sector sizes 2332 and 2336. * ISO parser: added support for Nintendo GameCube and Wii ISO images. * Extended medium type guess to distinguish between DVD and BluRay images based on length. * Removed fabrication of disc structures from the library (moved to CDEmu daemon). * MDS parser: cleanup of disc structure parsing, fixed the incorrectly set structure sizes. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2033=1 Package List: - openSUSE Leap 15.1 (x86_64): libmirage-3_2-3.2.2-lp151.3.3.1 libmirage-3_2-debuginfo-3.2.2-lp151.3.3.1 libmirage-debuginfo-3.2.2-lp151.3.3.1 libmirage-debugsource-3.2.2-lp151.3.3.1 libmirage-devel-3.2.2-lp151.3.3.1 libmirage11-3.2.2-lp151.3.3.1 libmirage11-debuginfo-3.2.2-lp151.3.3.1 typelib-1_0-libmirage-3_2-3.2.2-lp151.3.3.1 - openSUSE Leap 15.1 (noarch): libmirage-data-3.2.2-lp151.3.3.1 libmirage-lang-3.2.2-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-15540.html https://bugzilla.suse.com/1148087 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2024-1: moderate: Security update for qbittorrent
by opensuse-security＠opensuse.org 30 Aug '19

30 Aug '19

openSUSE Security Update: Security update for qbittorrent ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2024-1 Rating: moderate References: #1141967 Cross-References: CVE-2019-13640 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for qbittorrent fixes the following issues: - CVE-2019-13640: avoid command injection (boo#1141967) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2024=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): qbittorrent-4.1.5-bp151.3.3.1 qbittorrent-nox-4.1.5-bp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-13640.html https://bugzilla.suse.com/1141967 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2021-1: important: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork
by opensuse-security＠opensuse.org 29 Aug '19

29 Aug '19

openSUSE Security Update: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2021-1 Rating: important References: #1100331 #1121967 #1138920 #1139649 #1142160 #1142413 #1143409 Cross-References: CVE-2018-10892 CVE-2019-13509 CVE-2019-14271 CVE-2019-5736 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves four vulnerabilities and has three fixes is now available. Description: This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues: Docker: - CVE-2019-14271: Fixed a code injection if the nsswitch facility dynamically loaded a library inside a chroot (bsc#1143409). - CVE-2019-13509: Fixed an information leak in the debug log (bsc#1142160). - Update to version 19.03.1-ce, see changelog at /usr/share/doc/packages/docker/CHANGELOG.md (bsc#1142413, bsc#1139649). runc: - Use %config(noreplace) for /etc/docker/daemon.json (bsc#1138920). - Update to runc 425e105d5a03, which is required by Docker (bsc#1139649). containerd: - CVE-2019-5736: Fixed a container breakout vulnerability (bsc#1121967). - Update to containerd v1.2.6, which is required by docker (bsc#1139649). golang-github-docker-libnetwork: - Update to version git.fc5a7d91d54cc98f64fc28f9e288b46a0bee756c, which is required by docker (bsc#1142413, bsc#1139649). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2021=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2021=1 Package List: - openSUSE Leap 15.1 (x86_64): containerd-1.2.6-lp151.2.6.1 containerd-ctr-1.2.6-lp151.2.6.1 docker-19.03.1_ce-lp151.2.12.1 docker-debuginfo-19.03.1_ce-lp151.2.12.1 docker-libnetwork-0.7.0.1+gitr2800_fc5a7d91d54c-lp151.2.6.1 docker-libnetwork-debuginfo-0.7.0.1+gitr2800_fc5a7d91d54c-lp151.2.6.1 docker-runc-1.0.0rc8+gitr3826_425e105d5a03-lp151.3.6.1 docker-runc-debuginfo-1.0.0rc8+gitr3826_425e105d5a03-lp151.3.6.1 docker-test-19.03.1_ce-lp151.2.12.1 docker-test-debuginfo-19.03.1_ce-lp151.2.12.1 golang-github-docker-libnetwork-0.7.0.1+gitr2800_fc5a7d91d54c-lp151.2.6.1 - openSUSE Leap 15.1 (noarch): docker-bash-completion-19.03.1_ce-lp151.2.12.1 docker-zsh-completion-19.03.1_ce-lp151.2.12.1 - openSUSE Leap 15.0 (x86_64): containerd-1.2.6-lp150.4.17.1 containerd-ctr-1.2.6-lp150.4.17.1 docker-19.03.1_ce-lp150.5.27.1 docker-debuginfo-19.03.1_ce-lp150.5.27.1 docker-libnetwork-0.7.0.1+gitr2800_fc5a7d91d54c-lp150.3.18.1 docker-libnetwork-debuginfo-0.7.0.1+gitr2800_fc5a7d91d54c-lp150.3.18.1 docker-runc-1.0.0rc8+gitr3826_425e105d5a03-lp150.5.25.1 docker-runc-debuginfo-1.0.0rc8+gitr3826_425e105d5a03-lp150.5.25.1 docker-test-19.03.1_ce-lp150.5.27.1 docker-test-debuginfo-19.03.1_ce-lp150.5.27.1 golang-github-docker-libnetwork-0.7.0.1+gitr2800_fc5a7d91d54c-lp150.3.18.1 - openSUSE Leap 15.0 (noarch): docker-bash-completion-19.03.1_ce-lp150.5.27.1 docker-zsh-completion-19.03.1_ce-lp150.5.27.1 References: https://www.suse.com/security/cve/CVE-2018-10892.html https://www.suse.com/security/cve/CVE-2019-13509.html https://www.suse.com/security/cve/CVE-2019-14271.html https://www.suse.com/security/cve/CVE-2019-5736.html https://bugzilla.suse.com/1100331 https://bugzilla.suse.com/1121967 https://bugzilla.suse.com/1138920 https://bugzilla.suse.com/1139649 https://bugzilla.suse.com/1142160 https://bugzilla.suse.com/1142413 https://bugzilla.suse.com/1143409 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2019-1: important: Security update for schismtracker
by opensuse-security＠opensuse.org 29 Aug '19

29 Aug '19

openSUSE Security Update: Security update for schismtracker ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2019-1 Rating: important References: #1144261 #1144266 Cross-References: CVE-2019-14523 CVE-2019-14524 Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for schismtracker fixes the following issues: The following security issues were fixed: - CVE-2019-14523: Fixed an integer underflow in the Amiga Oktalyzer parser (boo#1144266). - CVE-2019-14524: Fixed a heap overflow in the MTM loader (boo#1144261). The following non-security issues were fixed: - Support 15-channel MOD files. - Support undocumented MIDI macro characters, and support character p (MIDI program) properly. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2019=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2019=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): schismtracker-20190805-bp151.4.3.1 schismtracker-debuginfo-20190805-bp151.4.3.1 schismtracker-debugsource-20190805-bp151.4.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): schismtracker-20190805-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-14523.html https://www.suse.com/security/cve/CVE-2019-14524.html https://bugzilla.suse.com/1144261 https://bugzilla.suse.com/1144266 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2017-1: moderate: Recommended update for putty
by opensuse-security＠opensuse.org 26 Aug '19

26 Aug '19

openSUSE Security Update: Recommended update for putty ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2017-1 Rating: moderate References: #1144547 #1144548 Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for putty fixes the following issues: Update to new upstream release 0.72 [boo#1144547, boo#1144548] * Fixed two separate vulnerabilities affecting the obsolete SSH-1 protocol, both available before host key checking. * Fixed a vulnerability in all the SSH client tools (PuTTY, Plink, PSFTP and PSCP) if a malicious program can impersonate Pageant. * Fixed a crash in GSSAPI / Kerberos key exchange triggered if the server provided an ordinary SSH host key as part of the exchange. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2017=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2017=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): putty-0.72-bp151.4.3.1 putty-debuginfo-0.72-bp151.4.3.1 putty-debugsource-0.72-bp151.4.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): putty-0.72-bp150.4.9.1 References: https://bugzilla.suse.com/1144547 https://bugzilla.suse.com/1144548 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2015-1: important: Security update for vlc
by opensuse-security＠opensuse.org 26 Aug '19

26 Aug '19

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2015-1 Rating: important References: #1093732 #1094893 #1118586 #1133290 #1138354 #1138933 #1141522 #1142161 #1143547 #1143549 Cross-References: CVE-2018-19857 CVE-2019-12874 CVE-2019-13602 CVE-2019-13962 CVE-2019-5439 CVE-2019-5459 CVE-2019-5460 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has three fixes is now available. Description: This update for vlc to version 3.0.7.1 fixes the following issues: Security issues fixed: - CVE-2019-5439: Fixed a buffer overflow (bsc#1138354). - CVE-2019-5459: Fixed an integer underflow (bsc#1143549). - CVE-2019-5460: Fixed a double free (bsc#1143547). - CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933). - CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522). - CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161). Non-security issues fixed: - Video Output: * Fix hardware acceleration with some AMD drivers * Improve direct3d11 HDR support - Access: * Improve Blu-ray support - Audio output: * Fix pass-through on Android-23 * Fix DirectSound drain - Demux: Improve MP4 support - Video Output: * Fix 12 bits sources playback with Direct3D11 * Fix crash on iOS * Fix midstream aspect-ratio changes when Windows hardware decoding is on * Fix HLG display with Direct3D11 - Stream Output: Improve Chromecast support with new ChromeCast apps - Misc: * Update Youtube, Dailymotion, Vimeo, Soundcloud scripts * Work around busy looping when playing an invalid item with loop enabled - Updated translations. New package libaom: * Initial version 1.0.0 * A library for AOMedia Video 1 (AV1), an open, royalty-free video coding format designed for video transmissions over the Internet. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2015=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): aom-tools-1.0.0-bp150.2.1 aom-tools-debuginfo-1.0.0-bp150.2.1 libaom-debugsource-1.0.0-bp150.2.1 libaom-devel-1.0.0-bp150.2.1 libaom0-1.0.0-bp150.2.1 libaom0-debuginfo-1.0.0-bp150.2.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libaom0-64bit-1.0.0-bp150.2.1 libaom0-64bit-debuginfo-1.0.0-bp150.2.1 - openSUSE Backports SLE-15 (x86_64): libvlc5-3.0.7.1-bp150.2.6.1 libvlccore9-3.0.7.1-bp150.2.6.1 vlc-3.0.7.1-bp150.2.6.1 vlc-codec-gstreamer-3.0.7.1-bp150.2.6.1 vlc-devel-3.0.7.1-bp150.2.6.1 vlc-jack-3.0.7.1-bp150.2.6.1 vlc-noX-3.0.7.1-bp150.2.6.1 vlc-qt-3.0.7.1-bp150.2.6.1 vlc-vdpau-3.0.7.1-bp150.2.6.1 - openSUSE Backports SLE-15 (noarch): libaom-devel-doc-1.0.0-bp150.2.1 vlc-lang-3.0.7.1-bp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-19857.html https://www.suse.com/security/cve/CVE-2019-12874.html https://www.suse.com/security/cve/CVE-2019-13602.html https://www.suse.com/security/cve/CVE-2019-13962.html https://www.suse.com/security/cve/CVE-2019-5439.html https://www.suse.com/security/cve/CVE-2019-5459.html https://www.suse.com/security/cve/CVE-2019-5460.html https://bugzilla.suse.com/1093732 https://bugzilla.suse.com/1094893 https://bugzilla.suse.com/1118586 https://bugzilla.suse.com/1133290 https://bugzilla.suse.com/1138354 https://bugzilla.suse.com/1138933 https://bugzilla.suse.com/1141522 https://bugzilla.suse.com/1142161 https://bugzilla.suse.com/1143547 https://bugzilla.suse.com/1143549 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2005-1: moderate: Security update for qbittorrent
by opensuse-security＠opensuse.org 24 Aug '19

24 Aug '19

openSUSE Security Update: Security update for qbittorrent ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2005-1 Rating: moderate References: #1141967 Cross-References: CVE-2019-13640 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for qbittorrent fixes the following issues: - CVE-2019-13640: avoid command injection (boo#1141967) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2005=1 Package List: - openSUSE Leap 15.1 (x86_64): qbittorrent-4.1.5-lp151.2.3.1 qbittorrent-debuginfo-4.1.5-lp151.2.3.1 qbittorrent-debugsource-4.1.5-lp151.2.3.1 qbittorrent-nox-4.1.5-lp151.2.3.1 qbittorrent-nox-debuginfo-4.1.5-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-13640.html https://bugzilla.suse.com/1141967 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0