August 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:1983-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 21 Aug '19

21 Aug '19

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1983-1 Rating: moderate References: #1139884 #1139885 #1139886 #1140100 #1140102 #1140103 #1140104 #1140105 #1140106 #1140110 #1140111 #1140501 #1140513 #1140520 #1140534 #1140538 #1140543 #1140545 #1140547 #1140549 #1140552 #1140554 #1140664 #1140665 #1140666 #1140667 #1140668 #1140669 #1140673 #1141171 Cross-References: CVE-2019-12974 CVE-2019-12975 CVE-2019-12976 CVE-2019-12977 CVE-2019-12978 CVE-2019-12979 CVE-2019-13133 CVE-2019-13134 CVE-2019-13135 CVE-2019-13136 CVE-2019-13137 CVE-2019-13295 CVE-2019-13296 CVE-2019-13297 CVE-2019-13298 CVE-2019-13299 CVE-2019-13300 CVE-2019-13301 CVE-2019-13302 CVE-2019-13303 CVE-2019-13304 CVE-2019-13305 CVE-2019-13306 CVE-2019-13307 CVE-2019-13308 CVE-2019-13309 CVE-2019-13310 CVE-2019-13311 CVE-2019-13391 CVE-2019-13454 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 30 vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: - CVE-2019-13301: Fixed a memory leak in AcquireMagickMemory() (bsc#1140554). - CVE-2019-13309: Fixed a memory leak at AcquireMagickMemory due to mishandling the NoSuchImage error in CLIListOperatorImages (bsc#1140520). - CVE-2019-13310: Fixed a memory leak at AcquireMagickMemory because of an error in MagickWand/mogrify.c (bsc#1140501). - CVE-2019-13311: Fixed a memory leak at AcquireMagickMemory because of a wand/mogrify.c error (bsc#1140513). - CVE-2019-13303: Fixed a heap-based buffer over-read in MagickCore/composite.c in CompositeImage (bsc#1140549). - CVE-2019-13296: Fixed a memory leak in AcquireMagickMemory because of an error in CLIListOperatorImages in MagickWand/operation.c (bsc#1140665). - CVE-2019-13299: Fixed a heap-based buffer over-read at MagickCore/pixel-accessor.h in GetPixelChannel (bsc#1140668). - CVE-2019-13454: Fixed a division by zero in RemoveDuplicateLayers in MagickCore/layer.c (bsc#1141171). - CVE-2019-13295: Fixed a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage (bsc#1140664). - CVE-2019-13297: Fixed a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage (bsc#1140666). - CVE-2019-12979: Fixed the use of uninitialized values in SyncImageSettings() (bsc#1139886). - CVE-2019-13391: Fixed a heap-based buffer over-read in MagickCore/fourier.c (bsc#1140673). - CVE-2019-13308: Fixed a heap-based buffer overflow in MagickCore/fourier.c (bsc#1140534). - CVE-2019-13302: Fixed a heap-based buffer over-read in MagickCore/fourier.c in ComplexImages (bsc#1140552). - CVE-2019-13298: Fixed a heap-based buffer overflow at MagickCore/pixel-accessor.h in SetPixelViaPixelInfo (bsc#1140667). - CVE-2019-13300: Fixed a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages (bsc#1140669). - CVE-2019-13307: Fixed a heap-based buffer overflow at MagickCore/statistic.c (bsc#1140538). - CVE-2019-12977: Fixed the use of uninitialized values in WriteJP2Imag() (bsc#1139884). - CVE-2019-12975: Fixed a memory leak in the WriteDPXImage() in coders/dpx.c (bsc#1140106). - CVE-2019-13135: Fixed the use of uninitialized values in ReadCUTImage() (bsc#1140103). - CVE-2019-12978: Fixed the use of uninitialized values in ReadPANGOImage() (bsc#1139885). - CVE-2019-12974: Fixed a NULL pointer dereference in the ReadPANGOImage() (bsc#1140111). - CVE-2019-13304: Fixed a stack-based buffer overflow at coders/pnm.c in WritePNMImage (bsc#1140547). - CVE-2019-13305: Fixed one more stack-based buffer overflow at coders/pnm.c in WritePNMImage (bsc#1140545). - CVE-2019-13306: Fixed an additional stack-based buffer overflow at coders/pnm.c in WritePNMImage (bsc#1140543). - CVE-2019-13133: Fixed a memory leak in the ReadBMPImage() (bsc#1140100). - CVE-2019-13134: Fixed a memory leak in the ReadVIFFImage() (bsc#1140102). - CVE-2019-13137: Fixed a memory leak in the ReadPSImage() (bsc#1140105). - CVE-2019-13136: Fixed a integer overflow vulnerability in the TIFFSeekCustomStream() (bsc#1140104). - CVE-2019-12976: Fixed a memory leak in the ReadPCLImage() in coders/pcl.c(bsc#1140110). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1983=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1983=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ImageMagick-7.0.7.34-lp151.7.9.1 ImageMagick-config-7-SUSE-7.0.7.34-lp151.7.9.1 ImageMagick-config-7-upstream-7.0.7.34-lp151.7.9.1 ImageMagick-debuginfo-7.0.7.34-lp151.7.9.1 ImageMagick-debugsource-7.0.7.34-lp151.7.9.1 ImageMagick-devel-7.0.7.34-lp151.7.9.1 ImageMagick-extra-7.0.7.34-lp151.7.9.1 ImageMagick-extra-debuginfo-7.0.7.34-lp151.7.9.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp151.7.9.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp151.7.9.1 libMagick++-devel-7.0.7.34-lp151.7.9.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp151.7.9.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp151.7.9.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp151.7.9.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp151.7.9.1 perl-PerlMagick-7.0.7.34-lp151.7.9.1 perl-PerlMagick-debuginfo-7.0.7.34-lp151.7.9.1 - openSUSE Leap 15.1 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp151.7.9.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp151.7.9.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp151.7.9.1 libMagick++-devel-32bit-7.0.7.34-lp151.7.9.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp151.7.9.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp151.7.9.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp151.7.9.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp151.7.9.1 - openSUSE Leap 15.1 (noarch): ImageMagick-doc-7.0.7.34-lp151.7.9.1 - openSUSE Leap 15.0 (i586 x86_64): ImageMagick-7.0.7.34-lp150.2.38.1 ImageMagick-config-7-SUSE-7.0.7.34-lp150.2.38.1 ImageMagick-config-7-upstream-7.0.7.34-lp150.2.38.1 ImageMagick-debuginfo-7.0.7.34-lp150.2.38.1 ImageMagick-debugsource-7.0.7.34-lp150.2.38.1 ImageMagick-devel-7.0.7.34-lp150.2.38.1 ImageMagick-extra-7.0.7.34-lp150.2.38.1 ImageMagick-extra-debuginfo-7.0.7.34-lp150.2.38.1 libMagick++-7_Q16HDRI4-7.0.7.34-lp150.2.38.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-lp150.2.38.1 libMagick++-devel-7.0.7.34-lp150.2.38.1 libMagickCore-7_Q16HDRI6-7.0.7.34-lp150.2.38.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.38.1 libMagickWand-7_Q16HDRI6-7.0.7.34-lp150.2.38.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-lp150.2.38.1 perl-PerlMagick-7.0.7.34-lp150.2.38.1 perl-PerlMagick-debuginfo-7.0.7.34-lp150.2.38.1 - openSUSE Leap 15.0 (x86_64): ImageMagick-devel-32bit-7.0.7.34-lp150.2.38.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp150.2.38.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-lp150.2.38.1 libMagick++-devel-32bit-7.0.7.34-lp150.2.38.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.38.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.38.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp150.2.38.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-lp150.2.38.1 - openSUSE Leap 15.0 (noarch): ImageMagick-doc-7.0.7.34-lp150.2.38.1 References: https://www.suse.com/security/cve/CVE-2019-12974.html https://www.suse.com/security/cve/CVE-2019-12975.html https://www.suse.com/security/cve/CVE-2019-12976.html https://www.suse.com/security/cve/CVE-2019-12977.html https://www.suse.com/security/cve/CVE-2019-12978.html https://www.suse.com/security/cve/CVE-2019-12979.html https://www.suse.com/security/cve/CVE-2019-13133.html https://www.suse.com/security/cve/CVE-2019-13134.html https://www.suse.com/security/cve/CVE-2019-13135.html https://www.suse.com/security/cve/CVE-2019-13136.html https://www.suse.com/security/cve/CVE-2019-13137.html https://www.suse.com/security/cve/CVE-2019-13295.html https://www.suse.com/security/cve/CVE-2019-13296.html https://www.suse.com/security/cve/CVE-2019-13297.html https://www.suse.com/security/cve/CVE-2019-13298.html https://www.suse.com/security/cve/CVE-2019-13299.html https://www.suse.com/security/cve/CVE-2019-13300.html https://www.suse.com/security/cve/CVE-2019-13301.html https://www.suse.com/security/cve/CVE-2019-13302.html https://www.suse.com/security/cve/CVE-2019-13303.html https://www.suse.com/security/cve/CVE-2019-13304.html https://www.suse.com/security/cve/CVE-2019-13305.html https://www.suse.com/security/cve/CVE-2019-13306.html https://www.suse.com/security/cve/CVE-2019-13307.html https://www.suse.com/security/cve/CVE-2019-13308.html https://www.suse.com/security/cve/CVE-2019-13309.html https://www.suse.com/security/cve/CVE-2019-13310.html https://www.suse.com/security/cve/CVE-2019-13311.html https://www.suse.com/security/cve/CVE-2019-13391.html https://www.suse.com/security/cve/CVE-2019-13454.html https://bugzilla.suse.com/1139884 https://bugzilla.suse.com/1139885 https://bugzilla.suse.com/1139886 https://bugzilla.suse.com/1140100 https://bugzilla.suse.com/1140102 https://bugzilla.suse.com/1140103 https://bugzilla.suse.com/1140104 https://bugzilla.suse.com/1140105 https://bugzilla.suse.com/1140106 https://bugzilla.suse.com/1140110 https://bugzilla.suse.com/1140111 https://bugzilla.suse.com/1140501 https://bugzilla.suse.com/1140513 https://bugzilla.suse.com/1140520 https://bugzilla.suse.com/1140534 https://bugzilla.suse.com/1140538 https://bugzilla.suse.com/1140543 https://bugzilla.suse.com/1140545 https://bugzilla.suse.com/1140547 https://bugzilla.suse.com/1140549 https://bugzilla.suse.com/1140552 https://bugzilla.suse.com/1140554 https://bugzilla.suse.com/1140664 https://bugzilla.suse.com/1140665 https://bugzilla.suse.com/1140666 https://bugzilla.suse.com/1140667 https://bugzilla.suse.com/1140668 https://bugzilla.suse.com/1140669 https://bugzilla.suse.com/1140673 https://bugzilla.suse.com/1141171 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1965-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 20 Aug '19

20 Aug '19

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1965-1 Rating: moderate References: #1141980 Cross-References: CVE-2019-13619 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for wireshark to version 2.4.16 fixes the following issues: Security issue fixed: - CVE-2019-13619: ASN.1 BER and related dissectors crash (bsc#1141980). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1965=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1965=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libwireshark9-2.4.16-lp151.2.6.1 libwireshark9-debuginfo-2.4.16-lp151.2.6.1 libwiretap7-2.4.16-lp151.2.6.1 libwiretap7-debuginfo-2.4.16-lp151.2.6.1 libwscodecs1-2.4.16-lp151.2.6.1 libwscodecs1-debuginfo-2.4.16-lp151.2.6.1 libwsutil8-2.4.16-lp151.2.6.1 libwsutil8-debuginfo-2.4.16-lp151.2.6.1 wireshark-2.4.16-lp151.2.6.1 wireshark-debuginfo-2.4.16-lp151.2.6.1 wireshark-debugsource-2.4.16-lp151.2.6.1 wireshark-devel-2.4.16-lp151.2.6.1 wireshark-ui-qt-2.4.16-lp151.2.6.1 wireshark-ui-qt-debuginfo-2.4.16-lp151.2.6.1 - openSUSE Leap 15.0 (i586 x86_64): libwireshark9-2.4.16-lp150.2.32.1 libwireshark9-debuginfo-2.4.16-lp150.2.32.1 libwiretap7-2.4.16-lp150.2.32.1 libwiretap7-debuginfo-2.4.16-lp150.2.32.1 libwscodecs1-2.4.16-lp150.2.32.1 libwscodecs1-debuginfo-2.4.16-lp150.2.32.1 libwsutil8-2.4.16-lp150.2.32.1 libwsutil8-debuginfo-2.4.16-lp150.2.32.1 wireshark-2.4.16-lp150.2.32.1 wireshark-debuginfo-2.4.16-lp150.2.32.1 wireshark-debugsource-2.4.16-lp150.2.32.1 wireshark-devel-2.4.16-lp150.2.32.1 wireshark-ui-qt-2.4.16-lp150.2.32.1 wireshark-ui-qt-debuginfo-2.4.16-lp150.2.32.1 References: https://www.suse.com/security/cve/CVE-2019-13619.html https://bugzilla.suse.com/1141980 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1963-1: moderate: Security update for squid
by opensuse-security＠opensuse.org 20 Aug '19

20 Aug '19

openSUSE Security Update: Security update for squid ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1963-1 Rating: moderate References: #1140738 Cross-References: CVE-2019-13345 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for squid fixes the following issues: Security issue fixed: - CVE-2019-13345: Fixed a cross site scripting vulnerability via user_name or auth parameter in cachemgr.cgi (bsc#1140738). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1963=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1963=1 Package List: - openSUSE Leap 15.1 (x86_64): squid-4.8-lp151.2.3.1 squid-debuginfo-4.8-lp151.2.3.1 squid-debugsource-4.8-lp151.2.3.1 - openSUSE Leap 15.0 (x86_64): squid-4.8-lp150.9.1 squid-debuginfo-4.8-lp150.9.1 squid-debugsource-4.8-lp150.9.1 References: https://www.suse.com/security/cve/CVE-2019-13345.html https://bugzilla.suse.com/1140738 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1968-1: moderate: Security update for libcryptopp
by opensuse-security＠opensuse.org 20 Aug '19

20 Aug '19

openSUSE Security Update: Security update for libcryptopp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1968-1 Rating: moderate References: #1143532 Cross-References: CVE-2019-14318 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libcryptopp fixes the following issues: - CVE-2019-14318: Fixed a timing side channel vulnerability in the ECDSA signature generation (boo#1143532). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1968=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1968=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1968=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1968=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libcryptopp-debugsource-5.6.5-lp151.3.3.1 libcryptopp-devel-5.6.5-lp151.3.3.1 libcryptopp5_6_5-5.6.5-lp151.3.3.1 libcryptopp5_6_5-debuginfo-5.6.5-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libcryptopp5_6_5-32bit-5.6.5-lp151.3.3.1 libcryptopp5_6_5-32bit-debuginfo-5.6.5-lp151.3.3.1 - openSUSE Leap 15.0 (i586 x86_64): libcryptopp-debugsource-5.6.5-lp150.2.3.1 libcryptopp-devel-5.6.5-lp150.2.3.1 libcryptopp5_6_5-5.6.5-lp150.2.3.1 libcryptopp5_6_5-debuginfo-5.6.5-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libcryptopp5_6_5-32bit-5.6.5-lp150.2.3.1 libcryptopp5_6_5-32bit-debuginfo-5.6.5-lp150.2.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libcryptopp-devel-5.6.5-bp151.4.3.1 libcryptopp5_6_5-5.6.5-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libcryptopp5_6_5-64bit-5.6.5-bp151.4.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libcryptopp-debugsource-5.6.5-bp150.3.3.1 libcryptopp-devel-5.6.5-bp150.3.3.1 libcryptopp5_6_5-5.6.5-bp150.3.3.1 libcryptopp5_6_5-debuginfo-5.6.5-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libcryptopp5_6_5-64bit-5.6.5-bp150.3.3.1 libcryptopp5_6_5-64bit-debuginfo-5.6.5-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-14318.html https://bugzilla.suse.com/1143532 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1964-1: moderate: Security update for tcpdump
by opensuse-security＠opensuse.org 20 Aug '19

20 Aug '19

openSUSE Security Update: Security update for tcpdump ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1964-1 Rating: moderate References: #1068716 #1142439 Cross-References: CVE-2017-16808 CVE-2019-1010220 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for tcpdump fixes the following issues: Security issues fixed: - CVE-2019-1010220: Fixed a buffer over-read in print_prefix() which may expose data (bsc#1142439). - CVE-2017-16808: Fixed a heap-based buffer over-read related to aoe_print() and lookup_emem() (bsc#1068716). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1964=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1964=1 Package List: - openSUSE Leap 15.1 (x86_64): tcpdump-4.9.2-lp151.4.3.1 tcpdump-debuginfo-4.9.2-lp151.4.3.1 tcpdump-debugsource-4.9.2-lp151.4.3.1 - openSUSE Leap 15.0 (x86_64): tcpdump-4.9.2-lp150.7.1 tcpdump-debuginfo-4.9.2-lp150.7.1 tcpdump-debugsource-4.9.2-lp150.7.1 References: https://www.suse.com/security/cve/CVE-2017-16808.html https://www.suse.com/security/cve/CVE-2019-1010220.html https://bugzilla.suse.com/1068716 https://bugzilla.suse.com/1142439 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1959-1: moderate: Security update for clementine
by opensuse-security＠opensuse.org 19 Aug '19

19 Aug '19

openSUSE Security Update: Security update for clementine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1959-1 Rating: moderate References: #1103041 Cross-References: CVE-2018-14332 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for clementine fixes the following issues: - CVE-2018-14332: Fixed a NULL ptr dereference (crash) in the moodbar pipeline (boo#1103041) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1959=1 Package List: - openSUSE Backports SLE-15-SP1 (x86_64): clementine-1.3.1-bp151.4.3.2 References: https://www.suse.com/security/cve/CVE-2018-14332.html https://bugzilla.suse.com/1103041 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1954-1: moderate: Security update for openexr
by opensuse-security＠opensuse.org 19 Aug '19

19 Aug '19

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1954-1 Rating: moderate References: #1061305 Cross-References: CVE-2017-14988 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openexr fixes the following issues: - CVE-2017-14988: Fixed a denial of service in Header::readfrom() (bsc#1061305). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1954=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1954=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libIlmImf-2_2-23-2.2.1-lp151.4.6.1 libIlmImf-2_2-23-debuginfo-2.2.1-lp151.4.6.1 libIlmImfUtil-2_2-23-2.2.1-lp151.4.6.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-lp151.4.6.1 openexr-2.2.1-lp151.4.6.1 openexr-debuginfo-2.2.1-lp151.4.6.1 openexr-debugsource-2.2.1-lp151.4.6.1 openexr-devel-2.2.1-lp151.4.6.1 openexr-doc-2.2.1-lp151.4.6.1 - openSUSE Leap 15.1 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-lp151.4.6.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-lp151.4.6.1 libIlmImfUtil-2_2-23-32bit-2.2.1-lp151.4.6.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-lp151.4.6.1 - openSUSE Leap 15.0 (i586 x86_64): libIlmImf-2_2-23-2.2.1-lp150.2.9.1 libIlmImf-2_2-23-debuginfo-2.2.1-lp150.2.9.1 libIlmImfUtil-2_2-23-2.2.1-lp150.2.9.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-lp150.2.9.1 openexr-2.2.1-lp150.2.9.1 openexr-debuginfo-2.2.1-lp150.2.9.1 openexr-debugsource-2.2.1-lp150.2.9.1 openexr-devel-2.2.1-lp150.2.9.1 openexr-doc-2.2.1-lp150.2.9.1 - openSUSE Leap 15.0 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-lp150.2.9.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-lp150.2.9.1 libIlmImfUtil-2_2-23-32bit-2.2.1-lp150.2.9.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2017-14988.html https://bugzilla.suse.com/1061305 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1952-1: moderate: Security update for zstd
by opensuse-security＠opensuse.org 19 Aug '19

19 Aug '19

openSUSE Security Update: Security update for zstd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1952-1 Rating: moderate References: #1082318 #1133297 #1142941 Cross-References: CVE-2019-11922 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for zstd fixes the following issues: - Update to version 1.4.2: * bug: Fix bug in zstd-0.5 decoder by @terrelln (#1696) * bug: Fix seekable decompression in-memory API by @iburinoc (#1695) * bug: Close minor memory leak in CLI by @LeeYoung624 (#1701) * misc: Validate blocks are smaller than size limit by @vivekmig (#1685) * misc: Restructure source files by @ephiepark (#1679) - Update to version 1.4.1: * bug: Fix data corruption in niche use cases by @terrelln (#1659) * bug: Fuzz legacy modes, fix uncovered bugs by @terrelln (#1593, #1594, #1595) * bug: Fix out of bounds read by @terrelln (#1590) * perf: Improve decode speed by ~7% @mgrice (#1668) * perf: Slightly improved compression ratio of level 3 and 4 (ZSTD_dfast) by @cyan4973 (#1681) * perf: Slightly faster compression speed when re-using a context by @cyan4973 (#1658) * perf: Improve compression ratio for small windowLog by @cyan4973 (#1624) * perf: Faster compression speed in high compression mode for repetitive data by @terrelln (#1635) * api: Add parameter to generate smaller dictionaries by @tyler-tran (#1656) * cli: Recognize symlinks when built in C99 mode by @felixhandte (#1640) * cli: Expose cpu load indicator for each file on -vv mode by @ephiepark (#1631) * cli: Restrict read permissions on destination files by @chungy (#1644) * cli: zstdgrep: handle -f flag by @felixhandte (#1618) * cli: zstdcat: follow symlinks by @vejnar (#1604) * doc: Remove extra size limit on compressed blocks by @felixhandte (#1689) * doc: Fix typo by @yk-tanigawa (#1633) * doc: Improve documentation on streaming buffer sizes by @cyan4973 (#1629) * build: CMake: support building with LZ4 @leeyoung624 (#1626) * build: CMake: install zstdless and zstdgrep by @leeyoung624 (#1647) * build: CMake: respect existing uninstall target by @j301scott (#1619) * build: Make: skip multithread tests when built without support by @michaelforney (#1620) * build: Make: Fix examples/ test target by @sjnam (#1603) * build: Meson: rename options out of deprecated namespace by @lzutao (#1665) * build: Meson: fix build by @lzutao (#1602) * build: Visual Studio: don't export symbols in static lib by @scharan (#1650) * build: Visual Studio: fix linking by @absotively (#1639) * build: Fix MinGW-W64 build by @myzhang1029 (#1600) * misc: Expand decodecorpus coverage by @ephiepark (#1664) - Add baselibs.conf: libarchive gained zstd support and provides -32bit libraries. This means, zstd also needs to provide -32bit libs. - Update to new upstream release 1.4.0 * perf: level 1 compression speed was improved * cli: added --[no-]compress-literals flag to enable or disable literal compression - Reword "real-time" in description by some actual statistics, because 603MB/s (lowest zstd level) is not "real-time" for quite some applications. - zstd 1.3.8: * better decompression speed on large files (+7%) and cold dictionaries (+15%) * slightly better compression ratio at high compression modes * new --rsyncable mode * support decompression of empty frames into NULL (used to be an error) * support ZSTD_CLEVEL environment variable * --no-progress flag, preserving final summary * various CLI fixes * fix race condition in one-pass compression functions that could allow out of bounds write (CVE-2019-11922, boo#1142941) - zstd 1.3.7: * fix ratio for dictionary compression at levels 9 and 10 * add man pages for zstdless and zstdgrep - includes changes from zstd 1.3.6: * faster dictionary builder, also the new default for --train * previous (slower, slightly higher quality) dictionary builder to be selected via --train-cover * Faster dictionary decompression and compression under memory limits with many dictionaries used simultaneously * New command --adapt for compressed network piping of data adjusted to the perceived network conditions - update to 1.3.5: * much faster dictionary compression * small quality improvement for dictionary generation * slightly improved performance at high compression levels * automatic memory release for long duration contexts * fix overlapLog can be manually set * fix decoding invalid lz4 frames * fix performance degradation for dictionary compression when using advanced API - fix pzstd tests - enable pzstd (parallel zstd) - Use %license instead of %doc [boo#1082318] - Add disk _constraints to fix ppc64le build - Use FAT LTO objects in order to provide proper static library (boo#1133297). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1952=1 Package List: - openSUSE Leap 15.0 (x86_64): libzstd-devel-1.4.2-lp150.2.3.1 libzstd-devel-static-1.4.2-lp150.2.3.1 libzstd1-1.4.2-lp150.2.3.1 libzstd1-debuginfo-1.4.2-lp150.2.3.1 zstd-1.4.2-lp150.2.3.1 zstd-debuginfo-1.4.2-lp150.2.3.1 zstd-debugsource-1.4.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-11922.html https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1133297 https://bugzilla.suse.com/1142941 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1951-1: moderate: Recommended update for dkgpg, libTMCG
by opensuse-security＠opensuse.org 19 Aug '19

19 Aug '19

openSUSE Security Update: Recommended update for dkgpg, libTMCG ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1951-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for dkgpg, libTMCG fixes the following issues: libTMCG was updated to version 1.3.18 * This release is two-fold: first, it fixes some bugs (e.g. iterated S2K) of the OpenPGP interface, and second, it adds functionality for handling v5 keys and signatures (see RFC 4880bis-07). Update to version 1.3.17 * VTMF,ASTC,DKG,VRHE,EOTP,COM,VSS: make CheckGroup() more robust * VSSHE: security bugfix for Verify_[non]interactive_[_publiccoin] * mpz_spowm: added check for correct base in fast exponentiation * mpz_sqrtm: remove unused parameter in tmcg_mpz_qrmn_p() * configure.ac: added compiler option "-Wextra" * mpz_sprime: added tmcg_mpz_smprime() with increased B = 80000 * RFC4880: changed type of tmcg_openpgp_mem_alloc to unsigned long Update to version 1.3.16 * changed constant TMCG_MAX_CARDS (decreased by factor 2) * changed formulas for TMCG_MAX_VALUE_CHARS and TMCG_MAX_KEY_CHARS * RFC4880: added support of Preferred AEAD Algorithms [RFC 4880bis] * RFC4880: added output for key usage "timestamping" [RFC 4880bis] * RFC4880: changed tmcg_openpgp_byte_t: unsigned char -> uint8_t * RFC4880: added PacketAeadEncode() [RFC 4880bis] * RFC4880: added SymmetricDecryptAEAD() and SymmetricEncryptAEAD() * changed formula for TMCG_MAX_KEYBITS (increased by factor 2) * mpz_srandom: bugfix in Botan code branch of mpz_grandomb() Update to version 1.3.15: * This is a maintenance release that fixes some bugs, e.g. in the Botan support of functions from module mpz_srandom. Moreover, some interfaces of the OpenPGP implemenation have been added and removed. For some modules of LibTMCG a basic exception handling has been introduced. Update to version 1.3.14: * With this release three additional parameters for the control of secure memory allocation have been added to init_libTMCG(). They are explained in the reference manual. Moreover, the OpenPGP interface has been enhanced in several way, e.g., ECDH, ECDSA and EdDSA are supported now. Update to 1.3.13: * Lots of major improvements for undocumented OpenPGP interface * PRNG from Botan is used as additional source of randomness * SHA3 is emulated if runtime version of libgcrypt is too old dkgpg was updated to version 1.1.3: * This is a bugfix release that includes only three minor improvements: a direct-key signature (0x1f) for the primary key is added by default such that restricting key servers (e.g. keys.openpgp.org) can deliver a cryptographically checkable key without verification of any included user ID or without appended subkey. The command line interface of dkg-decrypt has been improved in order to give users an easy access to the symmetric-key decryption mode. An additional option ("-5") for dkg-sign allows to generate V5 signatures (cf. draft RFC 4880bis). Update to version 1.1.2: * This release adds a lot of features to some programs: two new options ("-K" and "-f") allow dkg-keysign to read the certification key from a keyring instead of a single key block file. Moreover, with option "-a" an interactive confirmation by the user is required for each signature. Passive support of V5 keys (cf. draft RFC 4880bis) has been added for all programs, however, dkg-generate still generates V4 keys only, because this new feature of the draft is not widely spread. There is also a new encryption capability: an empty KEYSPEC tells dkg-encrypt to create a symmetric-key encrypted session key, i.e., the user has to supply a passphrase for encryption and decryption without any public-key cryptography involved. Last but not least, two bugs have been fixed: First, dkg-decrypt failed on many ZIP-compressed OpenPGP messages with "ZLIB ERROR: -3 invalid block type" due to a bug in decompression logic. Second, dkg-decrypt failed in a special case of symmetric-key encrypted session keys. Finally, the non-installing program dkg-fuzzer (generates fuzzy samples of somehow corrupted OpenPGP stuctures) has been added. Update to version 1.1.1: * Some small improvements have been applied for dkg-generate: Two new options ("-u" and "-N") allow providing the initial user ID and to disable the passphrase at command line. Moreover, since this release dkg-timestamp and dkg-timestamp-verify require a special key usage flag from recent RFC 4880bis draft to select so-called timestamping keys. Finally, the synchronization time of the internally used broadcast protocol was reduced to a more reasonable amount and in dkg-decrypt the detection of end of data for message and decryption shares was changed. Update to version 1.1.0: * This release supports Authenticated Encryption with Associated Data (AEAD) in accordance to RFC 4880bis (draft); this can be enforced with the new added option "-a" when dkg-(d)encrypt is used. For using domain parameters, as described in RFC 7919, one should specify the new option "-r", when dkg-gencrs is used. Last, for key generation (dkg-generate) the timestamp option was added ( "--timestamping") which sets a key usage flag. - Update to version 1.0.9 This release improves the possibilities of DKGPG further. With the new programs dkg-adduid and dkg-revuid an user ID can be added and revoked, respectively. The program dkg-revoke now supports a human-readable reason for revocation (by option "-R") and dkg-decrypt verifies an included signature according to a given key ring (option "-k"). Last but not least, by the program dkg-addrevoker an external revocation key can be specified. Update to version 1.0.8: * First of all, passive support for ECDSA, ECDH, and EdDSA (cf. RFC 6637 and Werner Koch's draft RFC 4880bis) has been added by relying on the most recent version of LibTMCG. The threshold signature scheme and the threshold encryption are still limited to finite field cryptography (i.e. DSA and ElGamal). Moreover, the programs generate and recognize a few other new OpenPGP features (e.g. issuer fingerprint subpackets) from RFC 4880bis. Compressed messages are now decompressed by the program dkg-decrypt using zlib Compression Library (and optionally by library routines from libbzip2). This completes DKGPG's compatibility with other OpenPGP software, however, the prefered compression algorithm (i.e. "no compression") in self-signatures of generated keys is kept for now. Support for symmetric-key decryption by dkg-decrypt has been added too. The program dkg-verify now reads the signature from a file, if option "-s" is used. To keep track of later protocol changes, all interactive programs include a version identifier in their common ID of the reliable broadcast channel. Thus programs from previous releases will not communicate with those of this release. With the new programs dkg-timestamp and dkg-timestamp-verify a OpenPGP timestamp signature can be generated and verified, respectively. Last but not least, by the new option "-y" some programs (dkg-generate, dkg-decrypt, dkg-sign, dkg-keysign, and dkg-timestamp) will work with regular OpenPGP keys too. The README file contains a configuration sample showing how to replace classic PGP by DKGPG in the famous mail user agent mutt based on this option. Please note that this feature is experimental and semantics may be changed later. Update to 1.0.7: * Small improvments due to the new OpenPGP structures from libTMCG * "-k" option has been added to further programs * OpenPGP cleartext signatures can be generated with the "-t" option * Output of potentially malicious user IDs has been sanitized in dkg-keycheck, dkg-keyinfo, and dkg-keysign Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1951=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1951=1 Package List: - openSUSE Leap 15.1 (x86_64): dkgpg-1.1.3-lp151.3.3.1 dkgpg-debuginfo-1.1.3-lp151.3.3.1 dkgpg-debugsource-1.1.3-lp151.3.3.1 libTMCG-debugsource-1.3.18-lp151.3.3.1 libTMCG-devel-1.3.18-lp151.3.3.1 libTMCG18-1.3.18-lp151.3.3.1 libTMCG18-debuginfo-1.3.18-lp151.3.3.1 - openSUSE Leap 15.0 (x86_64): dkgpg-1.1.3-lp150.2.3.1 dkgpg-debuginfo-1.1.3-lp150.2.3.1 dkgpg-debugsource-1.1.3-lp150.2.3.1 libTMCG-debugsource-1.3.18-lp150.2.3.1 libTMCG-devel-1.3.18-lp150.2.3.1 libTMCG18-1.3.18-lp150.2.3.1 libTMCG18-debuginfo-1.3.18-lp150.2.3.1 References: -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1928-1: important: Security update for chromium
by opensuse-security＠opensuse.org 18 Aug '19

18 Aug '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1928-1 Rating: important References: #1145242 Cross-References: CVE-2019-5867 CVE-2019-5868 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for chromium to verion 76.0.3809.100 fixes the following issues: - CVE-2019-5868: Use-after-free in PDFium ExecuteFieldAction (boo#1145242) - CVE-2019-5867: Out-of-bounds read in V8 (boo#1145242). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1928=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-76.0.3809.100-bp151.3.6.1 chromium-76.0.3809.100-bp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-5867.html https://www.suse.com/security/cve/CVE-2019-5868.html https://bugzilla.suse.com/1145242 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0