August 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:1917-1: important: Security update for gpg2
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for gpg2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1917-1 Rating: important References: #1124847 #1141093 Cross-References: CVE-2019-13050 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for gpg2 fixes the following issues: Security issue fixed: - CVE-2019-13050: Fixed a denial of service attacks via big keys (bsc#1141093). Non-security issue fixed: - Allow coredumps in X11 desktop sessions (bsc#1124847) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1917=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1917=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): gpg2-2.2.5-lp151.6.3.1 gpg2-debuginfo-2.2.5-lp151.6.3.1 gpg2-debugsource-2.2.5-lp151.6.3.1 - openSUSE Leap 15.1 (noarch): gpg2-lang-2.2.5-lp151.6.3.1 - openSUSE Leap 15.0 (i586 x86_64): gpg2-2.2.5-lp150.3.10.1 gpg2-debuginfo-2.2.5-lp150.3.10.1 gpg2-debugsource-2.2.5-lp150.3.10.1 - openSUSE Leap 15.0 (noarch): gpg2-lang-2.2.5-lp150.3.10.1 References: https://www.suse.com/security/cve/CVE-2019-13050.html https://bugzilla.suse.com/1124847 https://bugzilla.suse.com/1141093 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1916-1: important: Security update for java-11-openjdk
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for java-11-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1916-1 Rating: important References: #1115375 #1140461 #1141780 #1141781 #1141782 #1141783 #1141784 #1141785 #1141787 #1141788 #1141789 Cross-References: CVE-2019-2745 CVE-2019-2762 CVE-2019-2766 CVE-2019-2769 CVE-2019-2786 CVE-2019-2816 CVE-2019-2818 CVE-2019-2821 CVE-2019-7317 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 9 vulnerabilities and has two fixes is now available. Description: This update for java-11-openjdk to version jdk-11.0.4+11 fixes the following issues: Security issues fixed: - CVE-2019-2745: Improved ECC Implementation (bsc#1141784). - CVE-2019-2762: Exceptional throw cases (bsc#1141782). - CVE-2019-2766: Improve file protocol handling (bsc#1141789). - CVE-2019-2769: Better copies of CopiesList (bsc#1141783). - CVE-2019-2786: More limited privilege usage (bsc#1141787). - CVE-2019-7317: Improve PNG support options (bsc#1141780). - CVE-2019-2818: Better Poly1305 support (bsc#1141788). - CVE-2019-2816: Normalize normalization (bsc#1141785). - CVE-2019-2821: Improve TLS negotiation (bsc#1141781). - Certificate validation improvements Non-security issues fixed: - Do not fail installation when the manpages are not present (bsc#1115375) - Backport upstream fix for JDK-8208602: Cannot read PEM X.509 cert if there is whitespace after the header or footer (bsc#1140461) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1916=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1916=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): java-11-openjdk-11.0.4.0-lp151.3.6.1 java-11-openjdk-accessibility-11.0.4.0-lp151.3.6.1 java-11-openjdk-accessibility-debuginfo-11.0.4.0-lp151.3.6.1 java-11-openjdk-debuginfo-11.0.4.0-lp151.3.6.1 java-11-openjdk-debugsource-11.0.4.0-lp151.3.6.1 java-11-openjdk-demo-11.0.4.0-lp151.3.6.1 java-11-openjdk-devel-11.0.4.0-lp151.3.6.1 java-11-openjdk-headless-11.0.4.0-lp151.3.6.1 java-11-openjdk-jmods-11.0.4.0-lp151.3.6.1 java-11-openjdk-src-11.0.4.0-lp151.3.6.1 - openSUSE Leap 15.1 (noarch): java-11-openjdk-javadoc-11.0.4.0-lp151.3.6.1 - openSUSE Leap 15.0 (noarch): java-11-openjdk-javadoc-11.0.4.0-lp150.2.25.1 - openSUSE Leap 15.0 (x86_64): java-11-openjdk-11.0.4.0-lp150.2.25.1 java-11-openjdk-accessibility-11.0.4.0-lp150.2.25.1 java-11-openjdk-accessibility-debuginfo-11.0.4.0-lp150.2.25.1 java-11-openjdk-debuginfo-11.0.4.0-lp150.2.25.1 java-11-openjdk-debugsource-11.0.4.0-lp150.2.25.1 java-11-openjdk-demo-11.0.4.0-lp150.2.25.1 java-11-openjdk-devel-11.0.4.0-lp150.2.25.1 java-11-openjdk-headless-11.0.4.0-lp150.2.25.1 java-11-openjdk-jmods-11.0.4.0-lp150.2.25.1 java-11-openjdk-src-11.0.4.0-lp150.2.25.1 References: https://www.suse.com/security/cve/CVE-2019-2745.html https://www.suse.com/security/cve/CVE-2019-2762.html https://www.suse.com/security/cve/CVE-2019-2766.html https://www.suse.com/security/cve/CVE-2019-2769.html https://www.suse.com/security/cve/CVE-2019-2786.html https://www.suse.com/security/cve/CVE-2019-2816.html https://www.suse.com/security/cve/CVE-2019-2818.html https://www.suse.com/security/cve/CVE-2019-2821.html https://www.suse.com/security/cve/CVE-2019-7317.html https://bugzilla.suse.com/1115375 https://bugzilla.suse.com/1140461 https://bugzilla.suse.com/1141780 https://bugzilla.suse.com/1141781 https://bugzilla.suse.com/1141782 https://bugzilla.suse.com/1141783 https://bugzilla.suse.com/1141784 https://bugzilla.suse.com/1141785 https://bugzilla.suse.com/1141787 https://bugzilla.suse.com/1141788 https://bugzilla.suse.com/1141789 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1897-1: important: Security update for vlc
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1897-1 Rating: important References: #1118586 #1138354 #1138933 #1141522 #1142161 #1143547 #1143549 Cross-References: CVE-2018-19857 CVE-2019-12874 CVE-2019-13602 CVE-2019-13962 CVE-2019-5439 CVE-2019-5459 CVE-2019-5460 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for vlc to version 3.0.7.1 fixes the following issues: Security issues fixed: - CVE-2019-5439: Fixed a buffer overflow (bsc#1138354). - CVE-2019-5459: Fixed an integer underflow (bsc#1143549). - CVE-2019-5460: Fixed a double free (bsc#1143547). - CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933). - CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522). - CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161). Non-security issues fixed: - Video Output: * Fix hardware acceleration with some AMD drivers * Improve direct3d11 HDR support - Access: * Improve Blu-ray support - Audio output: * Fix pass-through on Android-23 * Fix DirectSound drain - Demux: Improve MP4 support - Video Output: * Fix 12 bits sources playback with Direct3D11 * Fix crash on iOS * Fix midstream aspect-ratio changes when Windows hardware decoding is on * Fix HLG display with Direct3D11 - Stream Output: Improve Chromecast support with new ChromeCast apps - Misc: * Update Youtube, Dailymotion, Vimeo, Soundcloud scripts * Work around busy looping when playing an invalid item with loop enabled - Updated translations. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1897=1 Package List: - openSUSE Backports SLE-15-SP1 (x86_64): libvlc5-3.0.7.1-bp151.5.3.3 libvlccore9-3.0.7.1-bp151.5.3.3 vlc-3.0.7.1-bp151.5.3.3 vlc-codec-gstreamer-3.0.7.1-bp151.5.3.3 vlc-devel-3.0.7.1-bp151.5.3.3 vlc-jack-3.0.7.1-bp151.5.3.3 vlc-noX-3.0.7.1-bp151.5.3.3 vlc-qt-3.0.7.1-bp151.5.3.3 vlc-vdpau-3.0.7.1-bp151.5.3.3 - openSUSE Backports SLE-15-SP1 (noarch): vlc-lang-3.0.7.1-bp151.5.3.3 References: https://www.suse.com/security/cve/CVE-2018-19857.html https://www.suse.com/security/cve/CVE-2019-12874.html https://www.suse.com/security/cve/CVE-2019-13602.html https://www.suse.com/security/cve/CVE-2019-13962.html https://www.suse.com/security/cve/CVE-2019-5439.html https://www.suse.com/security/cve/CVE-2019-5459.html https://www.suse.com/security/cve/CVE-2019-5460.html https://bugzilla.suse.com/1118586 https://bugzilla.suse.com/1138354 https://bugzilla.suse.com/1138933 https://bugzilla.suse.com/1141522 https://bugzilla.suse.com/1142161 https://bugzilla.suse.com/1143547 https://bugzilla.suse.com/1143549 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1904-1: important: Security update for pdns
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for pdns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1904-1 Rating: important References: #1138582 #1142810 Cross-References: CVE-2019-10162 CVE-2019-10163 CVE-2019-10203 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for pdns fixes the following issues: Security issues fixed: - CVE-2019-10203: Updated PostgreSQL schema to address a possible denial of service by an authorized user by inserting a crafted record in a MASTER type zone under their control. (boo#1142810) - CVE-2019-10162: Fixed a denial of service but when authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. (boo#1138582) - CVE-2019-10163: Fixed a denial of service of slave server when an authorized master server sends large number of NOTIFY messages. (boo#1138582) Non-security issues fixed: - Enabled the option to disable superslave support. - Fixed `pdnsutil b2b-migrate` to not lose NSEC3 settings. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1904=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1904=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1904=1 Package List: - openSUSE Leap 15.1 (x86_64): pdns-4.1.8-lp151.2.3.1 pdns-backend-geoip-4.1.8-lp151.2.3.1 pdns-backend-geoip-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-godbc-4.1.8-lp151.2.3.1 pdns-backend-godbc-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-ldap-4.1.8-lp151.2.3.1 pdns-backend-ldap-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-lua-4.1.8-lp151.2.3.1 pdns-backend-lua-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-mydns-4.1.8-lp151.2.3.1 pdns-backend-mydns-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-mysql-4.1.8-lp151.2.3.1 pdns-backend-mysql-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-postgresql-4.1.8-lp151.2.3.1 pdns-backend-postgresql-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-remote-4.1.8-lp151.2.3.1 pdns-backend-remote-debuginfo-4.1.8-lp151.2.3.1 pdns-backend-sqlite3-4.1.8-lp151.2.3.1 pdns-backend-sqlite3-debuginfo-4.1.8-lp151.2.3.1 pdns-debuginfo-4.1.8-lp151.2.3.1 pdns-debugsource-4.1.8-lp151.2.3.1 - openSUSE Leap 15.0 (x86_64): pdns-4.1.2-lp150.3.13.1 pdns-backend-geoip-4.1.2-lp150.3.13.1 pdns-backend-geoip-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-godbc-4.1.2-lp150.3.13.1 pdns-backend-godbc-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-ldap-4.1.2-lp150.3.13.1 pdns-backend-ldap-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-lua-4.1.2-lp150.3.13.1 pdns-backend-lua-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-mydns-4.1.2-lp150.3.13.1 pdns-backend-mydns-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-mysql-4.1.2-lp150.3.13.1 pdns-backend-mysql-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-postgresql-4.1.2-lp150.3.13.1 pdns-backend-postgresql-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-remote-4.1.2-lp150.3.13.1 pdns-backend-remote-debuginfo-4.1.2-lp150.3.13.1 pdns-backend-sqlite3-4.1.2-lp150.3.13.1 pdns-backend-sqlite3-debuginfo-4.1.2-lp150.3.13.1 pdns-debuginfo-4.1.2-lp150.3.13.1 pdns-debugsource-4.1.2-lp150.3.13.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): pdns-4.1.2-bp150.2.9.1 pdns-backend-geoip-4.1.2-bp150.2.9.1 pdns-backend-geoip-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-godbc-4.1.2-bp150.2.9.1 pdns-backend-godbc-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-ldap-4.1.2-bp150.2.9.1 pdns-backend-ldap-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-lua-4.1.2-bp150.2.9.1 pdns-backend-lua-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-mydns-4.1.2-bp150.2.9.1 pdns-backend-mydns-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-mysql-4.1.2-bp150.2.9.1 pdns-backend-mysql-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-postgresql-4.1.2-bp150.2.9.1 pdns-backend-postgresql-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-remote-4.1.2-bp150.2.9.1 pdns-backend-remote-debuginfo-4.1.2-bp150.2.9.1 pdns-backend-sqlite3-4.1.2-bp150.2.9.1 pdns-backend-sqlite3-debuginfo-4.1.2-bp150.2.9.1 pdns-debuginfo-4.1.2-bp150.2.9.1 pdns-debugsource-4.1.2-bp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2019-10162.html https://www.suse.com/security/cve/CVE-2019-10163.html https://www.suse.com/security/cve/CVE-2019-10203.html https://bugzilla.suse.com/1138582 https://bugzilla.suse.com/1142810 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1913-1: important: Security update for mariadb, mariadb-connector-c
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for mariadb, mariadb-connector-c ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1913-1 Rating: important References: #1126088 #1132666 #1136035 Cross-References: CVE-2019-2614 CVE-2019-2627 CVE-2019-2628 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for mariadb and mariadb-connector-c fixes the following issues: mariadb: - Update to version 10.2.25 (bsc#1136035) - CVE-2019-2628: Fixed a remote denial of service by an privileged attacker (bsc#1136035). - CVE-2019-2627: Fixed another remote denial of service by an privileged attacker (bsc#1136035). - CVE-2019-2614: Fixed a potential remote denial of service by an privileged attacker (bsc#1136035). - Fixed reading options for multiple instances if my${INSTANCE}.cnf is used (bsc#1132666) mariadb-connector-c: - Update to version 3.1.2 (bsc#1136035) - Moved libmariadb.pc from /usr/lib/pkgconfig to /usr/lib64/pkgconfig for x86_64 (bsc#1126088) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1913=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libmariadb-devel-3.1.2-lp151.3.3.1 libmariadb-devel-debuginfo-3.1.2-lp151.3.3.1 libmariadb3-3.1.2-lp151.3.3.1 libmariadb3-debuginfo-3.1.2-lp151.3.3.1 libmariadb_plugins-3.1.2-lp151.3.3.1 libmariadb_plugins-debuginfo-3.1.2-lp151.3.3.1 libmariadbprivate-3.1.2-lp151.3.3.1 libmariadbprivate-debuginfo-3.1.2-lp151.3.3.1 libmysqld-devel-10.2.25-lp151.2.3.1 libmysqld19-10.2.25-lp151.2.3.1 libmysqld19-debuginfo-10.2.25-lp151.2.3.1 mariadb-10.2.25-lp151.2.3.1 mariadb-bench-10.2.25-lp151.2.3.1 mariadb-bench-debuginfo-10.2.25-lp151.2.3.1 mariadb-client-10.2.25-lp151.2.3.1 mariadb-client-debuginfo-10.2.25-lp151.2.3.1 mariadb-connector-c-debugsource-3.1.2-lp151.3.3.1 mariadb-debuginfo-10.2.25-lp151.2.3.1 mariadb-debugsource-10.2.25-lp151.2.3.1 mariadb-galera-10.2.25-lp151.2.3.1 mariadb-test-10.2.25-lp151.2.3.1 mariadb-test-debuginfo-10.2.25-lp151.2.3.1 mariadb-tools-10.2.25-lp151.2.3.1 mariadb-tools-debuginfo-10.2.25-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): mariadb-errormessages-10.2.25-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): libmariadb3-32bit-3.1.2-lp151.3.3.1 libmariadb3-32bit-debuginfo-3.1.2-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-2614.html https://www.suse.com/security/cve/CVE-2019-2627.html https://www.suse.com/security/cve/CVE-2019-2628.html https://bugzilla.suse.com/1126088 https://bugzilla.suse.com/1132666 https://bugzilla.suse.com/1136035 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1898-1: important: Security update for kconfig, kdelibs4
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for kconfig, kdelibs4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1898-1 Rating: important References: #1144600 Cross-References: CVE-2019-14744 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kconfig, kdelibs4 fixes the following issues: - CVE-2019-14744: Fixed a command execution by an shell expansion (boo#1144600). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1898=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): kconf_update5-5.55.0-bp151.3.8.1 kconfig-devel-5.55.0-bp151.3.8.1 kdelibs4-4.14.38-bp151.9.8.2 kdelibs4-branding-upstream-4.14.38-bp151.9.8.2 kdelibs4-core-4.14.38-bp151.9.8.2 kdelibs4-core-debuginfo-4.14.38-bp151.9.8.2 kdelibs4-debuginfo-4.14.38-bp151.9.8.2 kdelibs4-debugsource-4.14.38-bp151.9.8.2 kdelibs4-doc-4.14.38-bp151.9.8.2 kdelibs4-doc-debuginfo-4.14.38-bp151.9.8.2 libKF5ConfigCore5-5.55.0-bp151.3.8.1 libKF5ConfigGui5-5.55.0-bp151.3.8.1 libkde4-4.14.38-bp151.9.8.2 libkde4-debuginfo-4.14.38-bp151.9.8.2 libkde4-devel-4.14.38-bp151.9.8.2 libkde4-devel-debuginfo-4.14.38-bp151.9.8.2 libkdecore4-4.14.38-bp151.9.8.2 libkdecore4-debuginfo-4.14.38-bp151.9.8.2 libkdecore4-devel-4.14.38-bp151.9.8.2 libkdecore4-devel-debuginfo-4.14.38-bp151.9.8.2 libksuseinstall-devel-4.14.38-bp151.9.8.2 libksuseinstall1-4.14.38-bp151.9.8.2 libksuseinstall1-debuginfo-4.14.38-bp151.9.8.2 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): kconfig-devel-64bit-5.55.0-bp151.3.8.1 libKF5ConfigCore5-64bit-5.55.0-bp151.3.8.1 libKF5ConfigGui5-64bit-5.55.0-bp151.3.8.1 libkde4-64bit-4.14.38-bp151.9.8.2 libkde4-64bit-debuginfo-4.14.38-bp151.9.8.2 libkdecore4-64bit-4.14.38-bp151.9.8.2 libkdecore4-64bit-debuginfo-4.14.38-bp151.9.8.2 libksuseinstall1-64bit-4.14.38-bp151.9.8.2 libksuseinstall1-64bit-debuginfo-4.14.38-bp151.9.8.2 - openSUSE Backports SLE-15-SP1 (noarch): kdelibs4-apidocs-4.14.38-bp151.9.8.1 libKF5ConfigCore5-lang-5.55.0-bp151.3.8.1 References: https://www.suse.com/security/cve/CVE-2019-14744.html https://bugzilla.suse.com/1144600 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1903-1: important: Security update for chromium
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1903-1 Rating: important References: #1145242 Cross-References: CVE-2019-5867 CVE-2019-5868 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for chromium to verion 76.0.3809.100 fixes the following issues: - CVE-2019-5868: Use-after-free in PDFium ExecuteFieldAction (boo#1145242) - CVE-2019-5867: Out-of-bounds read in V8 (boo#1145242). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1903=1 Package List: - openSUSE Leap 15.0 (x86_64): chromedriver-76.0.3809.100-lp150.229.1 chromedriver-debuginfo-76.0.3809.100-lp150.229.1 chromium-76.0.3809.100-lp150.229.1 chromium-debuginfo-76.0.3809.100-lp150.229.1 chromium-debugsource-76.0.3809.100-lp150.229.1 References: https://www.suse.com/security/cve/CVE-2019-5867.html https://www.suse.com/security/cve/CVE-2019-5868.html https://bugzilla.suse.com/1145242 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1915-1: important: Security update for mariadb, mariadb-connector-c
by opensuse-security＠opensuse.org 15 Aug '19

15 Aug '19

openSUSE Security Update: Security update for mariadb, mariadb-connector-c ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1915-1 Rating: important References: #1126088 #1132666 #1136035 Cross-References: CVE-2019-2614 CVE-2019-2627 CVE-2019-2628 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for mariadb and mariadb-connector-c fixes the following issues: mariadb: - Update to version 10.2.25 (bsc#1136035) - CVE-2019-2628: Fixed a remote denial of service by an privileged attacker (bsc#1136035). - CVE-2019-2627: Fixed another remote denial of service by an privileged attacker (bsc#1136035). - CVE-2019-2614: Fixed a potential remote denial of service by an privileged attacker (bsc#1136035). - Fixed reading options for multiple instances if my${INSTANCE}.cnf is used (bsc#1132666) mariadb-connector-c: - Update to version 3.1.2 (bsc#1136035) - Moved libmariadb.pc from /usr/lib/pkgconfig to /usr/lib64/pkgconfig for x86_64 (bsc#1126088) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1915=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libmariadb-devel-3.1.2-lp150.10.1 libmariadb-devel-debuginfo-3.1.2-lp150.10.1 libmariadb3-3.1.2-lp150.10.1 libmariadb3-debuginfo-3.1.2-lp150.10.1 libmariadb_plugins-3.1.2-lp150.10.1 libmariadb_plugins-debuginfo-3.1.2-lp150.10.1 libmariadbprivate-3.1.2-lp150.10.1 libmariadbprivate-debuginfo-3.1.2-lp150.10.1 libmysqld-devel-10.2.25-lp150.2.13.1 libmysqld19-10.2.25-lp150.2.13.1 libmysqld19-debuginfo-10.2.25-lp150.2.13.1 mariadb-10.2.25-lp150.2.13.1 mariadb-bench-10.2.25-lp150.2.13.1 mariadb-bench-debuginfo-10.2.25-lp150.2.13.1 mariadb-client-10.2.25-lp150.2.13.1 mariadb-client-debuginfo-10.2.25-lp150.2.13.1 mariadb-connector-c-debugsource-3.1.2-lp150.10.1 mariadb-debuginfo-10.2.25-lp150.2.13.1 mariadb-debugsource-10.2.25-lp150.2.13.1 mariadb-galera-10.2.25-lp150.2.13.1 mariadb-test-10.2.25-lp150.2.13.1 mariadb-test-debuginfo-10.2.25-lp150.2.13.1 mariadb-tools-10.2.25-lp150.2.13.1 mariadb-tools-debuginfo-10.2.25-lp150.2.13.1 - openSUSE Leap 15.0 (noarch): mariadb-errormessages-10.2.25-lp150.2.13.1 - openSUSE Leap 15.0 (x86_64): libmariadb3-32bit-3.1.2-lp150.10.1 libmariadb3-32bit-debuginfo-3.1.2-lp150.10.1 References: https://www.suse.com/security/cve/CVE-2019-2614.html https://www.suse.com/security/cve/CVE-2019-2627.html https://www.suse.com/security/cve/CVE-2019-2628.html https://bugzilla.suse.com/1126088 https://bugzilla.suse.com/1132666 https://bugzilla.suse.com/1136035 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1891-1: moderate: Security update for libqb
by opensuse-security＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Security Update: Security update for libqb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1891-1 Rating: moderate References: #1137835 Cross-References: CVE-2019-12779 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libqb fixes the following issue: Security issue fixed: - CVE-2019-12779: Fixed an insecure treatment of IPC temporary files which could have allowed a local attacker to overwrite privileged system files (bsc#1137835). This update was imported from the SUSE:SLE-15-SP1:Update update project. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1891=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libqb-devel-1.0.3+20190326.a521604-bp151.2.3.1 libqb-tests-1.0.3+20190326.a521604-bp151.2.3.1 libqb-tools-1.0.3+20190326.a521604-bp151.2.3.1 libqb20-1.0.3+20190326.a521604-bp151.2.3.1 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libqb-devel-64bit-1.0.3+20190326.a521604-bp151.2.3.1 libqb20-64bit-1.0.3+20190326.a521604-bp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-12779.html https://bugzilla.suse.com/1137835 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1894-1: moderate: Security update for irssi
by opensuse-security＠opensuse.org 14 Aug '19

14 Aug '19

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1894-1 Rating: moderate References: #1139802 Cross-References: CVE-2019-13045 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for irssi fixes the following issues: irssi was updated to 1.1.3: - CVE-2019-13045: Fix a use after free issue when sending the SASL login on (automatic and manual) reconnects (#1055, #1058) (boo#1139802) - Fix regression of #779 where autolog_ignore_targets would not matching itemless windows anymore (#1012, #1013) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-1894=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): irssi-1.1.3-bp151.3.3.3 irssi-devel-1.1.3-bp151.3.3.3 References: https://www.suse.com/security/cve/CVE-2019-13045.html https://bugzilla.suse.com/1139802 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0