August 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:1914-1: important: Security update for polkit
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for polkit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1914-1 Rating: important References: #1121826 Cross-References: CVE-2019-6133 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for polkit fixes the following issues: Security issue fixed: - CVE-2019-6133: Fixed improper caching of auth decisions, which could bypass uid checking in the interactive backend (bsc#1121826). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1914=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1914=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpolkit0-0.114-lp151.5.3.1 libpolkit0-debuginfo-0.114-lp151.5.3.1 polkit-0.114-lp151.5.3.1 polkit-debuginfo-0.114-lp151.5.3.1 polkit-debugsource-0.114-lp151.5.3.1 polkit-devel-0.114-lp151.5.3.1 polkit-devel-debuginfo-0.114-lp151.5.3.1 typelib-1_0-Polkit-1_0-0.114-lp151.5.3.1 - openSUSE Leap 15.1 (x86_64): libpolkit0-32bit-0.114-lp151.5.3.1 libpolkit0-32bit-debuginfo-0.114-lp151.5.3.1 - openSUSE Leap 15.1 (noarch): polkit-doc-0.114-lp151.5.3.1 - openSUSE Leap 15.0 (i586 x86_64): libpolkit0-0.114-lp150.2.10.1 libpolkit0-debuginfo-0.114-lp150.2.10.1 polkit-0.114-lp150.2.10.1 polkit-debuginfo-0.114-lp150.2.10.1 polkit-debugsource-0.114-lp150.2.10.1 polkit-devel-0.114-lp150.2.10.1 polkit-devel-debuginfo-0.114-lp150.2.10.1 typelib-1_0-Polkit-1_0-0.114-lp150.2.10.1 - openSUSE Leap 15.0 (x86_64): libpolkit0-32bit-0.114-lp150.2.10.1 libpolkit0-32bit-debuginfo-0.114-lp150.2.10.1 - openSUSE Leap 15.0 (noarch): polkit-doc-0.114-lp150.2.10.1 References: https://www.suse.com/security/cve/CVE-2019-6133.html https://bugzilla.suse.com/1121826 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1901-1: important: Security update for chromium
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1901-1 Rating: important References: #1143492 #1144625 Cross-References: CVE-2019-5850 CVE-2019-5851 CVE-2019-5852 CVE-2019-5853 CVE-2019-5854 CVE-2019-5855 CVE-2019-5856 CVE-2019-5857 CVE-2019-5858 CVE-2019-5859 CVE-2019-5860 CVE-2019-5861 CVE-2019-5862 CVE-2019-5863 CVE-2019-5864 CVE-2019-5865 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for chromium to version 76.0.3809.87 fixes the following issues: - CVE-2019-5850: Use-after-free in offline page fetcher (boo#1143492) - CVE-2019-5860: Use-after-free in PDFium (boo#1143492) - CVE-2019-5853: Memory corruption in regexp length check (boo#1143492) - CVE-2019-5851: Use-after-poison in offline audio context (boo#1143492) - CVE-2019-5859: res: URIs can load alternative browsers (boo#1143492) - CVE-2019-5856: Insufficient checks on filesystem: URI permissions (boo#1143492) - CVE-2019-5855: Integer overflow in PDFium (boo#1143492) - CVE-2019-5865: Site isolation bypass from compromised renderer (boo#1143492) - CVE-2019-5858: Insufficient filtering of Open URL service parameters (boo#1143492) - CVE-2019-5864: Insufficient port filtering in CORS for extensions (boo#1143492) - CVE-2019-5862: AppCache not robust to compromised renderers (boo#1143492) - CVE-2019-5861: Click location incorrectly checked (boo#1143492) - CVE-2019-5857: Comparison of -0 and null yields crash (boo#1143492) - CVE-2019-5854: Integer overflow in PDFium text rendering (boo#1143492) - CVE-2019-5852: Object leak of utility functions (boo#1143492) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1901=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-76.0.3809.87-bp151.3.3.3 chromium-76.0.3809.87-bp151.3.3.3 References: https://www.suse.com/security/cve/CVE-2019-5850.html https://www.suse.com/security/cve/CVE-2019-5851.html https://www.suse.com/security/cve/CVE-2019-5852.html https://www.suse.com/security/cve/CVE-2019-5853.html https://www.suse.com/security/cve/CVE-2019-5854.html https://www.suse.com/security/cve/CVE-2019-5855.html https://www.suse.com/security/cve/CVE-2019-5856.html https://www.suse.com/security/cve/CVE-2019-5857.html https://www.suse.com/security/cve/CVE-2019-5858.html https://www.suse.com/security/cve/CVE-2019-5859.html https://www.suse.com/security/cve/CVE-2019-5860.html https://www.suse.com/security/cve/CVE-2019-5861.html https://www.suse.com/security/cve/CVE-2019-5862.html https://www.suse.com/security/cve/CVE-2019-5863.html https://www.suse.com/security/cve/CVE-2019-5864.html https://www.suse.com/security/cve/CVE-2019-5865.html https://bugzilla.suse.com/1143492 https://bugzilla.suse.com/1144625 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1905-1: important: Security update for dosbox
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for dosbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1905-1 Rating: important References: #1140254 Cross-References: CVE-2019-12594 CVE-2019-7165 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for dosbox fixes the following issues: Security issues fixed: - CVE-2019-7165: Fixed that a very long line inside a bat file would overflow the parsing buffer (bnc#1140254). - CVE-2019-12594: Added a basic permission system so that a program running inside DOSBox can't access the contents of /proc (e.g. /proc/self/mem) when / or /proc were (to be) mounted (bnc#1140254). - Several other fixes for out of bounds access and buffer overflows. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1905=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1905=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1905=1 Package List: - openSUSE Leap 15.1 (x86_64): dosbox-0.74.3-lp151.3.3.1 dosbox-debuginfo-0.74.3-lp151.3.3.1 dosbox-debugsource-0.74.3-lp151.3.3.1 - openSUSE Leap 15.0 (x86_64): dosbox-0.74.3-lp150.2.3.1 dosbox-debuginfo-0.74.3-lp150.2.3.1 dosbox-debugsource-0.74.3-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): dosbox-0.74.3-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-12594.html https://www.suse.com/security/cve/CVE-2019-7165.html https://bugzilla.suse.com/1140254 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1908-1: important: Security update for evince
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for evince ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1908-1 Rating: important References: #1141619 Cross-References: CVE-2019-1010006 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for evince fixes the following issues: - CVE-2019-1010006: Fixed a buffer overflow in backend/tiff/tiff-document.c (bsc#1141619). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1908=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1908=1 Package List: - openSUSE Leap 15.1 (noarch): evince-lang-3.26.0+20180128.1bd86963-lp151.4.6.1 - openSUSE Leap 15.1 (x86_64): evince-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-debugsource-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-devel-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-comicsdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-comicsdocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-djvudocument-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-djvudocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-dvidocument-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-dvidocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-pdfdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-pdfdocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-psdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-psdocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-tiffdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-tiffdocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-xpsdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-xpsdocument-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 libevdocument3-4-3.26.0+20180128.1bd86963-lp151.4.6.1 libevdocument3-4-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 libevview3-3-3.26.0+20180128.1bd86963-lp151.4.6.1 libevview3-3-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 nautilus-evince-3.26.0+20180128.1bd86963-lp151.4.6.1 nautilus-evince-debuginfo-3.26.0+20180128.1bd86963-lp151.4.6.1 typelib-1_0-EvinceDocument-3_0-3.26.0+20180128.1bd86963-lp151.4.6.1 typelib-1_0-EvinceView-3_0-3.26.0+20180128.1bd86963-lp151.4.6.1 - openSUSE Leap 15.0 (noarch): evince-lang-3.26.0+20180128.1bd86963-lp150.3.6.1 - openSUSE Leap 15.0 (x86_64): evince-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-debugsource-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-devel-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-comicsdocument-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-comicsdocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-djvudocument-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-djvudocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-dvidocument-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-dvidocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-pdfdocument-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-pdfdocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-psdocument-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-psdocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-tiffdocument-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-tiffdocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-xpsdocument-3.26.0+20180128.1bd86963-lp150.3.6.1 evince-plugin-xpsdocument-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 libevdocument3-4-3.26.0+20180128.1bd86963-lp150.3.6.1 libevdocument3-4-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 libevview3-3-3.26.0+20180128.1bd86963-lp150.3.6.1 libevview3-3-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 nautilus-evince-3.26.0+20180128.1bd86963-lp150.3.6.1 nautilus-evince-debuginfo-3.26.0+20180128.1bd86963-lp150.3.6.1 typelib-1_0-EvinceDocument-3_0-3.26.0+20180128.1bd86963-lp150.3.6.1 typelib-1_0-EvinceView-3_0-3.26.0+20180128.1bd86963-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-1010006.html https://bugzilla.suse.com/1141619 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1911-1: important: Security update for icedtea-web
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for icedtea-web ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1911-1 Rating: important References: #1142825 #1142832 #1142835 Cross-References: CVE-2019-10181 CVE-2019-10182 CVE-2019-10185 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for icedtea-web to version 1.7.2 fixes the following issues: Security issues fixed: - CVE-2019-10181: Fixed an unsigned code injection in a signed JAR file (bsc#1142835) - CVE-2019-10182: Fixed a path traversal while processing <jar/> elements of JNLP files results in arbitrary file overwrite (bsc#1142825). - CVE-2019-10185: Fixed a directory traversal in the nested jar auto-extraction leading to arbitrary file overwrite (bsc#1142832). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1911=1 Package List: - openSUSE Leap 15.0 (x86_64): icedtea-web-1.7.2-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): icedtea-web-javadoc-1.7.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-10181.html https://www.suse.com/security/cve/CVE-2019-10182.html https://www.suse.com/security/cve/CVE-2019-10185.html https://bugzilla.suse.com/1142825 https://bugzilla.suse.com/1142832 https://bugzilla.suse.com/1142835 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1912-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1912-1 Rating: important References: #1115375 #1141780 #1141782 #1141783 #1141784 #1141785 #1141786 #1141787 #1141789 Cross-References: CVE-2019-2745 CVE-2019-2762 CVE-2019-2766 CVE-2019-2769 CVE-2019-2786 CVE-2019-2816 CVE-2019-2842 CVE-2019-7317 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has one errata is now available. Description: This update for java-1_8_0-openjdk to version 8u222 fixes the following issues: Security issues fixed: - CVE-2019-2745: Improved ECC Implementation (bsc#1141784). - CVE-2019-2762: Exceptional throw cases (bsc#1141782). - CVE-2019-2766: Improve file protocol handling (bsc#1141789). - CVE-2019-2769: Better copies of CopiesList (bsc#1141783). - CVE-2019-2786: More limited privilege usage (bsc#1141787). - CVE-2019-2816: Normalize normalization (bsc#1141785). - CVE-2019-2842: Extended AES support (bsc#1141786). - CVE-2019-7317: Improve PNG support (bsc#1141780). - Certificate validation improvements Non-security issue fixed: - Fixed an issue where the installation failed when the manpages are not present (bsc#1115375) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1912=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1912=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): java-1_8_0-openjdk-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-accessibility-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-debuginfo-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-debugsource-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-demo-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-devel-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-headless-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.222-lp151.2.3.1 java-1_8_0-openjdk-src-1.8.0.222-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.222-lp151.2.3.1 - openSUSE Leap 15.0 (i586 x86_64): java-1_8_0-openjdk-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-accessibility-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-debuginfo-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-debugsource-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-demo-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-devel-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-headless-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.222-lp150.2.19.1 java-1_8_0-openjdk-src-1.8.0.222-lp150.2.19.1 - openSUSE Leap 15.0 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.222-lp150.2.19.1 References: https://www.suse.com/security/cve/CVE-2019-2745.html https://www.suse.com/security/cve/CVE-2019-2762.html https://www.suse.com/security/cve/CVE-2019-2766.html https://www.suse.com/security/cve/CVE-2019-2769.html https://www.suse.com/security/cve/CVE-2019-2786.html https://www.suse.com/security/cve/CVE-2019-2816.html https://www.suse.com/security/cve/CVE-2019-2842.html https://www.suse.com/security/cve/CVE-2019-7317.html https://bugzilla.suse.com/1115375 https://bugzilla.suse.com/1141780 https://bugzilla.suse.com/1141782 https://bugzilla.suse.com/1141783 https://bugzilla.suse.com/1141784 https://bugzilla.suse.com/1141785 https://bugzilla.suse.com/1141786 https://bugzilla.suse.com/1141787 https://bugzilla.suse.com/1141789 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1902-1: important: Security update for chromium
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1902-1 Rating: important References: #1145242 Cross-References: CVE-2019-5867 CVE-2019-5868 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for chromium to verion 76.0.3809.100 fixes the following issues: - CVE-2019-5868: Use-after-free in PDFium ExecuteFieldAction (boo#1145242) - CVE-2019-5867: Out-of-bounds read in V8 (boo#1145242). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1902=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-76.0.3809.100-lp151.2.20.1 chromedriver-debuginfo-76.0.3809.100-lp151.2.20.1 chromium-76.0.3809.100-lp151.2.20.1 chromium-debuginfo-76.0.3809.100-lp151.2.20.1 chromium-debugsource-76.0.3809.100-lp151.2.20.1 References: https://www.suse.com/security/cve/CVE-2019-5867.html https://www.suse.com/security/cve/CVE-2019-5868.html https://bugzilla.suse.com/1145242 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1906-1: important: Security update for python
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1906-1 Rating: important References: #1138459 Cross-References: CVE-2019-10160 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python fixes the following issues: Security issue fixed: - CVE-2019-10160: Fixed a regression in urlparse() and urlsplit() introduced by the fix for CVE-2019-9636 (bsc#1138459). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1906=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1906=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpython2_7-1_0-2.7.14-lp151.10.3.1 libpython2_7-1_0-debuginfo-2.7.14-lp151.10.3.1 python-2.7.14-lp151.10.3.1 python-base-2.7.14-lp151.10.3.1 python-base-debuginfo-2.7.14-lp151.10.3.1 python-base-debugsource-2.7.14-lp151.10.3.1 python-curses-2.7.14-lp151.10.3.1 python-curses-debuginfo-2.7.14-lp151.10.3.1 python-debuginfo-2.7.14-lp151.10.3.1 python-debugsource-2.7.14-lp151.10.3.1 python-demo-2.7.14-lp151.10.3.1 python-devel-2.7.14-lp151.10.3.1 python-gdbm-2.7.14-lp151.10.3.1 python-gdbm-debuginfo-2.7.14-lp151.10.3.1 python-idle-2.7.14-lp151.10.3.1 python-tk-2.7.14-lp151.10.3.1 python-tk-debuginfo-2.7.14-lp151.10.3.1 python-xml-2.7.14-lp151.10.3.1 python-xml-debuginfo-2.7.14-lp151.10.3.1 - openSUSE Leap 15.1 (noarch): python-doc-2.7.14-lp151.10.3.1 python-doc-pdf-2.7.14-lp151.10.3.1 - openSUSE Leap 15.1 (x86_64): libpython2_7-1_0-32bit-2.7.14-lp151.10.3.1 libpython2_7-1_0-32bit-debuginfo-2.7.14-lp151.10.3.1 python-32bit-2.7.14-lp151.10.3.1 python-32bit-debuginfo-2.7.14-lp151.10.3.1 python-base-32bit-2.7.14-lp151.10.3.1 python-base-32bit-debuginfo-2.7.14-lp151.10.3.1 - openSUSE Leap 15.0 (i586 x86_64): python-2.7.14-lp150.6.13.1 python-curses-2.7.14-lp150.6.13.1 python-curses-debuginfo-2.7.14-lp150.6.13.1 python-debuginfo-2.7.14-lp150.6.13.1 python-debugsource-2.7.14-lp150.6.13.1 python-demo-2.7.14-lp150.6.13.1 python-gdbm-2.7.14-lp150.6.13.1 python-gdbm-debuginfo-2.7.14-lp150.6.13.1 python-idle-2.7.14-lp150.6.13.1 python-tk-2.7.14-lp150.6.13.1 python-tk-debuginfo-2.7.14-lp150.6.13.1 - openSUSE Leap 15.0 (x86_64): python-32bit-2.7.14-lp150.6.13.1 python-32bit-debuginfo-2.7.14-lp150.6.13.1 References: https://www.suse.com/security/cve/CVE-2019-10160.html https://bugzilla.suse.com/1138459 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1904-1: important: Security update for pdns
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for pdns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1904-1 Rating: important References: #1138582 #1142810 Cross-References: CVE-2019-10162 CVE-2019-10163 CVE-2019-10203 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for pdns fixes the following issues: Security issues fixed: - CVE-2019-10203: Updated PostgreSQL schema to address a possible denial of service by an authorized user by inserting a crafted record in a MASTER type zone under their control. (boo#1142810) - CVE-2019-10162: Fixed a denial of service but when authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. (boo#1138582) - CVE-2019-10163: Fixed a denial of service of slave server when an authorized master server sends large number of NOTIFY messages. (boo#1138582) Non-security issues fixed: - Enabled the option to disable superslave support. - Fixed `pdnsutil b2b-migrate` to not lose NSEC3 settings. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1904=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1904=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1904=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-1904=1 Package List: - openSUSE Leap 15.1 (x86_64): pdns-4.1.8-lp151.2.3.1 pdns-backend-geoip-4.1.8-lp151.2.3.1 pdns-backend-geoip-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-godbc-4.1.8-lp151.2.3.1 pdns-backend-godbc-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-ldap-4.1.8-lp151.2.3.1 pdns-backend-ldap-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-lua-4.1.8-lp151.2.3.1 pdns-backend-lua-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-mydns-4.1.8-lp151.2.3.1 pdns-backend-mydns-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-mysql-4.1.8-lp151.2.3.1 pdns-backend-mysql-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-postgresql-4.1.8-lp151.2.3.1 pdns-backend-postgresql-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-remote-4.1.8-lp151.2.3.1 pdns-backend-remote-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-sqlite3-4.1.8-lp151.2.3.1 pdns-backend-sqlite3-debuginfo-4.1.8-lp151.2.3.1 pdns-debuginfo-4.1.8-lp151.2.3.1 pdns-debugsource-4.1.8-lp151.2.3.1 - openSUSE Leap 15.0 (x86_64): pdns-4.1.2-lp150.3.13.1 pdns-backend-geoip-4.1.2-lp150.3.13.1 pdns-backend-geoip-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-godbc-4.1.2-lp150.3.13.1 pdns-backend-godbc-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-ldap-4.1.2-lp150.3.13.1 pdns-backend-ldap-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-lua-4.1.2-lp150.3.13.1 pdns-backend-lua-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-mydns-4.1.2-lp150.3.13.1 pdns-backend-mydns-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-mysql-4.1.2-lp150.3.13.1 pdns-backend-mysql-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-postgresql-4.1.2-lp150.3.13.1 pdns-backend-postgresql-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-remote-4.1.2-lp150.3.13.1 pdns-backend-remote-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-sqlite3-4.1.2-lp150.3.13.1 pdns-backend-sqlite3-debuginfo-4.1.2-lp150.3.13.1 pdns-debuginfo-4.1.2-lp150.3.13.1 pdns-debugsource-4.1.2-lp150.3.13.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): pdns-4.1.2-bp150.2.9.1 pdns-backend-geoip-4.1.2-bp150.2.9.1 pdns-backend-geoip-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-godbc-4.1.2-bp150.2.9.1 pdns-backend-godbc-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-ldap-4.1.2-bp150.2.9.1 pdns-backend-ldap-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-lua-4.1.2-bp150.2.9.1 pdns-backend-lua-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-mydns-4.1.2-bp150.2.9.1 pdns-backend-mydns-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-mysql-4.1.2-bp150.2.9.1 pdns-backend-mysql-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-postgresql-4.1.2-bp150.2.9.1 pdns-backend-postgresql-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-remote-4.1.2-bp150.2.9.1 pdns-backend-remote-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-sqlite3-4.1.2-bp150.2.9.1 pdns-backend-sqlite3-debuginfo-4.1.2-bp150.2.9.1 pdns-debuginfo-4.1.2-bp150.2.9.1 pdns-debugsource-4.1.2-bp150.2.9.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): pdns-4.1.11-20.1 pdns-backend-godbc-4.1.11-20.1 pdns-backend-ldap-4.1.11-20.1 pdns-backend-lua-4.1.11-20.1 pdns-backend-mydns-4.1.11-20.1 pdns-backend-mysql-4.1.11-20.1 pdns-backend-postgresql-4.1.11-20.1 pdns-backend-remote-4.1.11-20.1 pdns-backend-sqlite3-4.1.11-20.1 References: https://www.suse.com/security/cve/CVE-2019-10162.html https://www.suse.com/security/cve/CVE-2019-10163.html https://www.suse.com/security/cve/CVE-2019-10203.html https://bugzilla.suse.com/1138582 https://bugzilla.suse.com/1142810 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1909-1: important: Security update for vlc
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1909-1 Rating: important References: #1093732 #1094893 #1118586 #1133290 #1138354 #1138933 #1141522 #1142161 #1143547 #1143549 Cross-References: CVE-2018-19857 CVE-2019-12874 CVE-2019-13602 CVE-2019-13962 CVE-2019-5439 CVE-2019-5459 CVE-2019-5460 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has three fixes is now available. Description: This update for vlc to version 3.0.7.1 fixes the following issues: Security issues fixed: - CVE-2019-5439: Fixed a buffer overflow (bsc#1138354). - CVE-2019-5459: Fixed an integer underflow (bsc#1143549). - CVE-2019-5460: Fixed a double free (bsc#1143547). - CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933). - CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522). - CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161). Non-security issues fixed: - Video Output: * Fix hardware acceleration with some AMD drivers * Improve direct3d11 HDR support - Access: * Improve Blu-ray support - Audio output: * Fix pass-through on Android-23 * Fix DirectSound drain - Demux: Improve MP4 support - Video Output: * Fix 12 bits sources playback with Direct3D11 * Fix crash on iOS * Fix midstream aspect-ratio changes when Windows hardware decoding is on * Fix HLG display with Direct3D11 - Stream Output: Improve Chromecast support with new ChromeCast apps - Misc: * Update Youtube, Dailymotion, Vimeo, Soundcloud scripts * Work around busy looping when playing an invalid item with loop enabled - Updated translations. New package libaom: * Initial version 1.0.0 * A library for AOMedia Video 1 (AV1), an open, royalty-free video coding format designed for video transmissions over the Internet. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1909=1 Package List: - openSUSE Leap 15.0 (noarch): libaom-devel-doc-1.0.0-lp150.2.1 vlc-lang-3.0.7.1-lp150.8.1 - openSUSE Leap 15.0 (x86_64): aom-tools-1.0.0-lp150.2.1 aom-tools-debuginfo-1.0.0-lp150.2.1 libaom-debugsource-1.0.0-lp150.2.1 libaom-devel-1.0.0-lp150.2.1 libaom0-1.0.0-lp150.2.1 libaom0-debuginfo-1.0.0-lp150.2.1 libvlc5-3.0.7.1-lp150.8.1 libvlc5-debuginfo-3.0.7.1-lp150.8.1 libvlccore9-3.0.7.1-lp150.8.1 libvlccore9-debuginfo-3.0.7.1-lp150.8.1 vlc-3.0.7.1-lp150.8.1 vlc-codec-gstreamer-3.0.7.1-lp150.8.1 vlc-codec-gstreamer-debuginfo-3.0.7.1-lp150.8.1 vlc-debuginfo-3.0.7.1-lp150.8.1 vlc-debugsource-3.0.7.1-lp150.8.1 vlc-devel-3.0.7.1-lp150.8.1 vlc-jack-3.0.7.1-lp150.8.1 vlc-jack-debuginfo-3.0.7.1-lp150.8.1 vlc-noX-3.0.7.1-lp150.8.1 vlc-noX-debuginfo-3.0.7.1-lp150.8.1 vlc-qt-3.0.7.1-lp150.8.1 vlc-qt-debuginfo-3.0.7.1-lp150.8.1 vlc-vdpau-3.0.7.1-lp150.8.1 vlc-vdpau-debuginfo-3.0.7.1-lp150.8.1 References: https://www.suse.com/security/cve/CVE-2018-19857.html https://www.suse.com/security/cve/CVE-2019-12874.html https://www.suse.com/security/cve/CVE-2019-13602.html https://www.suse.com/security/cve/CVE-2019-13962.html https://www.suse.com/security/cve/CVE-2019-5439.html https://www.suse.com/security/cve/CVE-2019-5459.html https://www.suse.com/security/cve/CVE-2019-5460.html https://bugzilla.suse.com/1093732 https://bugzilla.suse.com/1094893 https://bugzilla.suse.com/1118586 https://bugzilla.suse.com/1133290 https://bugzilla.suse.com/1138354 https://bugzilla.suse.com/1138933 https://bugzilla.suse.com/1141522 https://bugzilla.suse.com/1142161 https://bugzilla.suse.com/1143547 https://bugzilla.suse.com/1143549 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0