August 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:1848-1: important: Security update for chromium
by opensuse-security＠opensuse.org 12 Aug '19

12 Aug '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1848-1 Rating: important References: #1143492 #1144625 Cross-References: CVE-2019-5850 CVE-2019-5851 CVE-2019-5852 CVE-2019-5853 CVE-2019-5854 CVE-2019-5855 CVE-2019-5856 CVE-2019-5857 CVE-2019-5858 CVE-2019-5859 CVE-2019-5860 CVE-2019-5861 CVE-2019-5862 CVE-2019-5863 CVE-2019-5864 CVE-2019-5865 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for chromium to version 76.0.3809.87 fixes the following issues: - CVE-2019-5850: Use-after-free in offline page fetcher (boo#1143492) - CVE-2019-5860: Use-after-free in PDFium (boo#1143492) - CVE-2019-5853: Memory corruption in regexp length check (boo#1143492) - CVE-2019-5851: Use-after-poison in offline audio context (boo#1143492) - CVE-2019-5859: res: URIs can load alternative browsers (boo#1143492) - CVE-2019-5856: Insufficient checks on filesystem: URI permissions (boo#1143492) - CVE-2019-5855: Integer overflow in PDFium (boo#1143492) - CVE-2019-5865: Site isolation bypass from compromised renderer (boo#1143492) - CVE-2019-5858: Insufficient filtering of Open URL service parameters (boo#1143492) - CVE-2019-5864: Insufficient port filtering in CORS for extensions (boo#1143492) - CVE-2019-5862: AppCache not robust to compromised renderers (boo#1143492) - CVE-2019-5861: Click location incorrectly checked (boo#1143492) - CVE-2019-5857: Comparison of -0 and null yields crash (boo#1143492) - CVE-2019-5854: Integer overflow in PDFium text rendering (boo#1143492) - CVE-2019-5852: Object leak of utility functions (boo#1143492) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1848=1 Package List: - openSUSE Leap 15.0 (x86_64): chromedriver-76.0.3809.87-lp150.224.1 chromedriver-debuginfo-76.0.3809.87-lp150.224.1 chromium-76.0.3809.87-lp150.224.1 chromium-debuginfo-76.0.3809.87-lp150.224.1 chromium-debugsource-76.0.3809.87-lp150.224.1 References: https://www.suse.com/security/cve/CVE-2019-5850.html https://www.suse.com/security/cve/CVE-2019-5851.html https://www.suse.com/security/cve/CVE-2019-5852.html https://www.suse.com/security/cve/CVE-2019-5853.html https://www.suse.com/security/cve/CVE-2019-5854.html https://www.suse.com/security/cve/CVE-2019-5855.html https://www.suse.com/security/cve/CVE-2019-5856.html https://www.suse.com/security/cve/CVE-2019-5857.html https://www.suse.com/security/cve/CVE-2019-5858.html https://www.suse.com/security/cve/CVE-2019-5859.html https://www.suse.com/security/cve/CVE-2019-5860.html https://www.suse.com/security/cve/CVE-2019-5861.html https://www.suse.com/security/cve/CVE-2019-5862.html https://www.suse.com/security/cve/CVE-2019-5863.html https://www.suse.com/security/cve/CVE-2019-5864.html https://www.suse.com/security/cve/CVE-2019-5865.html https://bugzilla.suse.com/1143492 https://bugzilla.suse.com/1144625 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1845-1: moderate: Security update for zstd
by opensuse-security＠opensuse.org 12 Aug '19

12 Aug '19

openSUSE Security Update: Security update for zstd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1845-1 Rating: moderate References: #1082318 #1133297 #1142941 Cross-References: CVE-2019-11922 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for zstd to version 1.4.2 fixes the following issues: Security issues fixed: - CVE-2019-11922: Fixed race condition in one-pass compression functions that could allow out of bounds write (boo#1142941). Non-security issues fixed: - Added --[no-]compress-literals CLI flag to enable or disable literal compression. - Added new --rsyncable mode. - Added handling of -f flag to zstdgrep. - Added CPU load indicator for each file on -vv mode. - Changed --no-progress flag to preserve the final summary. - Added new command --adapt for compressed network piping of data adjusted to the perceived network conditions. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1845=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libzstd-devel-1.4.2-lp151.3.3.1 libzstd-devel-static-1.4.2-lp151.3.3.1 libzstd1-1.4.2-lp151.3.3.1 libzstd1-debuginfo-1.4.2-lp151.3.3.1 zstd-1.4.2-lp151.3.3.1 zstd-debuginfo-1.4.2-lp151.3.3.1 zstd-debugsource-1.4.2-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libzstd1-32bit-1.4.2-lp151.3.3.1 libzstd1-32bit-debuginfo-1.4.2-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-11922.html https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1133297 https://bugzilla.suse.com/1142941 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1844-1: important: Security update for osc
by opensuse-security＠opensuse.org 12 Aug '19

12 Aug '19

openSUSE Security Update: Security update for osc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1844-1 Rating: important References: #1129889 #1138977 #1140697 #1142518 #1142662 #1144211 Cross-References: CVE-2019-3685 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has 5 fixes is now available. Description: This update for osc to version 0.165.4 fixes the following issues: Security issue fixed: - CVE-2019-3685: Fixed broken TLS certificate handling allowing for a Man-in-the-middle attack (bsc#1142518). Non-security issues fixed: - support different token operations (runservice, release and rebuild) (requires OBS 2.10) - fix osc token decode error - offline build mode is now really offline and does not try to download the buildconfig - osc build -define now works with python3 - fixes an issue where the error message on osc meta -e was not parsed correctly - osc maintainer -s now works with python3 - simplified and fixed osc meta -e (bsc#1138977) - osc lbl now works with non utf8 encoding (bsc#1129889) - add simpleimage as local build type - allow optional fork when creating a maintenance request - fix RPMError fallback - fix local caching for all package formats - fix appname for trusted cert store - osc -h does not break anymore when using plugins - switch to difflib.diff_bytes and sys.stdout.buffer.write for diffing. This will fix all decoding issues with osc diff, osc ci and osc rq -d - fix osc ls -lb handling empty size and mtime - removed decoding on osc api command. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1844=1 Package List: - openSUSE Leap 15.1 (noarch): osc-0.165.4-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-3685.html https://bugzilla.suse.com/1129889 https://bugzilla.suse.com/1138977 https://bugzilla.suse.com/1140697 https://bugzilla.suse.com/1142518 https://bugzilla.suse.com/1142662 https://bugzilla.suse.com/1144211 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1839-1: moderate: Security update for python-Django
by opensuse-security＠opensuse.org 08 Aug '19

08 Aug '19

openSUSE Security Update: Security update for python-Django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1839-1 Rating: moderate References: #1136468 #1139945 #1142880 #1142882 #1142883 #1142885 Cross-References: CVE-2019-11358 CVE-2019-12308 CVE-2019-12781 CVE-2019-14232 CVE-2019-14233 CVE-2019-14234 CVE-2019-14235 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for python-Django fixes the following issues: Security issues fixed: - CVE-2019-11358: Fixed prototype pollution. - CVE-2019-12308: Fixed XSS in AdminURLFieldWidget (bsc#1136468) - CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945). - CVE-2019-14232: Fixed denial-of-service possibility in ``django.utils.text.Truncator`` (bsc#1142880). - CVE-2019-14233: Fixed denial-of-service possibility in ``strip_tags()`` (bsc#1142882). - CVE-2019-14234: Fixed SQL injection possibility in key and index lookups for ``JSONField``/``HStoreField`` (bsc#1142883). - CVE-2019-14235: Fixed potential memory exhaustion in ``django.utils.encoding.uri_to_iri()`` (bsc#1142885). Non-security issues fixed: - Fixed a migration crash on PostgreSQL when adding a check constraint with a contains lookup on DateRangeField or DateTimeRangeField, if the right hand side of an expression is the same type. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1839=1 Package List: - openSUSE Leap 15.1 (noarch): python3-Django-2.2.4-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-11358.html https://www.suse.com/security/cve/CVE-2019-12308.html https://www.suse.com/security/cve/CVE-2019-12781.html https://www.suse.com/security/cve/CVE-2019-14232.html https://www.suse.com/security/cve/CVE-2019-14233.html https://www.suse.com/security/cve/CVE-2019-14234.html https://www.suse.com/security/cve/CVE-2019-14235.html https://bugzilla.suse.com/1136468 https://bugzilla.suse.com/1139945 https://bugzilla.suse.com/1142880 https://bugzilla.suse.com/1142882 https://bugzilla.suse.com/1142883 https://bugzilla.suse.com/1142885 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1840-1: important: Security update for vlc
by opensuse-security＠opensuse.org 08 Aug '19

08 Aug '19

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1840-1 Rating: important References: #1118586 #1138354 #1138933 #1141522 #1142161 #1143547 #1143549 Cross-References: CVE-2018-19857 CVE-2019-12874 CVE-2019-13602 CVE-2019-13962 CVE-2019-5439 CVE-2019-5459 CVE-2019-5460 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for vlc to version 3.0.7.1 fixes the following issues: Security issues fixed: - CVE-2019-5439: Fixed a buffer overflow (bsc#1138354). - CVE-2019-5459: Fixed an integer underflow (bsc#1143549). - CVE-2019-5460: Fixed a double free (bsc#1143547). - CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933). - CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522). - CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161). Non-security issues fixed: - Video Output: * Fix hardware acceleration with some AMD drivers * Improve direct3d11 HDR support - Access: * Improve Blu-ray support - Audio output: * Fix pass-through on Android-23 * Fix DirectSound drain - Demux: Improve MP4 support - Video Output: * Fix 12 bits sources playback with Direct3D11 * Fix crash on iOS * Fix midstream aspect-ratio changes when Windows hardware decoding is on * Fix HLG display with Direct3D11 - Stream Output: Improve Chromecast support with new ChromeCast apps - Misc: * Update Youtube, Dailymotion, Vimeo, Soundcloud scripts * Work around busy looping when playing an invalid item with loop enabled - Updated translations. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1840=1 Package List: - openSUSE Leap 15.1 (x86_64): libvlc5-3.0.7.1-lp151.6.3.1 libvlc5-debuginfo-3.0.7.1-lp151.6.3.1 libvlccore9-3.0.7.1-lp151.6.3.1 libvlccore9-debuginfo-3.0.7.1-lp151.6.3.1 vlc-3.0.7.1-lp151.6.3.1 vlc-codec-gstreamer-3.0.7.1-lp151.6.3.1 vlc-codec-gstreamer-debuginfo-3.0.7.1-lp151.6.3.1 vlc-debuginfo-3.0.7.1-lp151.6.3.1 vlc-debugsource-3.0.7.1-lp151.6.3.1 vlc-devel-3.0.7.1-lp151.6.3.1 vlc-jack-3.0.7.1-lp151.6.3.1 vlc-jack-debuginfo-3.0.7.1-lp151.6.3.1 vlc-noX-3.0.7.1-lp151.6.3.1 vlc-noX-debuginfo-3.0.7.1-lp151.6.3.1 vlc-qt-3.0.7.1-lp151.6.3.1 vlc-qt-debuginfo-3.0.7.1-lp151.6.3.1 vlc-vdpau-3.0.7.1-lp151.6.3.1 vlc-vdpau-debuginfo-3.0.7.1-lp151.6.3.1 - openSUSE Leap 15.1 (noarch): vlc-lang-3.0.7.1-lp151.6.3.1 References: https://www.suse.com/security/cve/CVE-2018-19857.html https://www.suse.com/security/cve/CVE-2019-12874.html https://www.suse.com/security/cve/CVE-2019-13602.html https://www.suse.com/security/cve/CVE-2019-13962.html https://www.suse.com/security/cve/CVE-2019-5439.html https://www.suse.com/security/cve/CVE-2019-5459.html https://www.suse.com/security/cve/CVE-2019-5460.html https://bugzilla.suse.com/1118586 https://bugzilla.suse.com/1138354 https://bugzilla.suse.com/1138933 https://bugzilla.suse.com/1141522 https://bugzilla.suse.com/1142161 https://bugzilla.suse.com/1143547 https://bugzilla.suse.com/1143549 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1836-1: important: Security update for proftpd
by opensuse-security＠opensuse.org 08 Aug '19

08 Aug '19

openSUSE Security Update: Security update for proftpd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1836-1 Rating: important References: #1142281 Cross-References: CVE-2017-7418 CVE-2019-12815 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for proftpd fixes the following issues: Security issues fixed: - CVE-2019-12815: Fixed arbitrary file copy in mod_copy that allowed for remote code execution and information disclosure without authentication (bnc#1142281). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1836=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1836=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1836=1 Package List: - openSUSE Leap 15.1 (x86_64): proftpd-1.3.5e-lp151.3.3.1 proftpd-debuginfo-1.3.5e-lp151.3.3.1 proftpd-debugsource-1.3.5e-lp151.3.3.1 proftpd-devel-1.3.5e-lp151.3.3.1 proftpd-doc-1.3.5e-lp151.3.3.1 proftpd-ldap-1.3.5e-lp151.3.3.1 proftpd-ldap-debuginfo-1.3.5e-lp151.3.3.1 proftpd-mysql-1.3.5e-lp151.3.3.1 proftpd-mysql-debuginfo-1.3.5e-lp151.3.3.1 proftpd-pgsql-1.3.5e-lp151.3.3.1 proftpd-pgsql-debuginfo-1.3.5e-lp151.3.3.1 proftpd-radius-1.3.5e-lp151.3.3.1 proftpd-radius-debuginfo-1.3.5e-lp151.3.3.1 proftpd-sqlite-1.3.5e-lp151.3.3.1 proftpd-sqlite-debuginfo-1.3.5e-lp151.3.3.1 - openSUSE Leap 15.1 (noarch): proftpd-lang-1.3.5e-lp151.3.3.1 - openSUSE Leap 15.0 (x86_64): proftpd-1.3.5e-lp150.2.3.1 proftpd-debuginfo-1.3.5e-lp150.2.3.1 proftpd-debugsource-1.3.5e-lp150.2.3.1 proftpd-devel-1.3.5e-lp150.2.3.1 proftpd-doc-1.3.5e-lp150.2.3.1 proftpd-ldap-1.3.5e-lp150.2.3.1 proftpd-ldap-debuginfo-1.3.5e-lp150.2.3.1 proftpd-mysql-1.3.5e-lp150.2.3.1 proftpd-mysql-debuginfo-1.3.5e-lp150.2.3.1 proftpd-pgsql-1.3.5e-lp150.2.3.1 proftpd-pgsql-debuginfo-1.3.5e-lp150.2.3.1 proftpd-radius-1.3.5e-lp150.2.3.1 proftpd-radius-debuginfo-1.3.5e-lp150.2.3.1 proftpd-sqlite-1.3.5e-lp150.2.3.1 proftpd-sqlite-debuginfo-1.3.5e-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): proftpd-lang-1.3.5e-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): proftpd-1.3.5e-bp150.3.3.1 proftpd-devel-1.3.5e-bp150.3.3.1 proftpd-doc-1.3.5e-bp150.3.3.1 proftpd-ldap-1.3.5e-bp150.3.3.1 proftpd-mysql-1.3.5e-bp150.3.3.1 proftpd-pgsql-1.3.5e-bp150.3.3.1 proftpd-radius-1.3.5e-bp150.3.3.1 proftpd-sqlite-1.3.5e-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): proftpd-lang-1.3.5e-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2017-7418.html https://www.suse.com/security/cve/CVE-2019-12815.html https://bugzilla.suse.com/1142281 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1834-1: moderate: Security update for aubio
by opensuse-security＠opensuse.org 06 Aug '19

06 Aug '19

openSUSE Security Update: Security update for aubio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1834-1 Rating: moderate References: #1137823 #1142433 #1142435 #1142436 Cross-References: CVE-2018-19802 CVE-2019-1010222 CVE-2019-1010223 CVE-2019-1010224 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for aubio fixes the following issues: - CVE-2019-1010224: Fixed a denial of service (boo#1142435). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1834=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): aubio-debugsource-0.4.6-lp150.3.13.1 aubio-tools-0.4.6-lp150.3.13.1 aubio-tools-debuginfo-0.4.6-lp150.3.13.1 libaubio-devel-0.4.6-lp150.3.13.1 libaubio5-0.4.6-lp150.3.13.1 libaubio5-debuginfo-0.4.6-lp150.3.13.1 - openSUSE Leap 15.0 (x86_64): libaubio5-32bit-0.4.6-lp150.3.13.1 libaubio5-32bit-debuginfo-0.4.6-lp150.3.13.1 python-aubio-debugsource-0.4.6-lp150.3.13.1 python2-aubio-0.4.6-lp150.3.13.1 python2-aubio-debuginfo-0.4.6-lp150.3.13.1 python3-aubio-0.4.6-lp150.3.13.1 python3-aubio-debuginfo-0.4.6-lp150.3.13.1 References: https://www.suse.com/security/cve/CVE-2018-19802.html https://www.suse.com/security/cve/CVE-2019-1010222.html https://www.suse.com/security/cve/CVE-2019-1010223.html https://www.suse.com/security/cve/CVE-2019-1010224.html https://bugzilla.suse.com/1137823 https://bugzilla.suse.com/1142433 https://bugzilla.suse.com/1142435 https://bugzilla.suse.com/1142436 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1831-1: moderate: Security update for spamassassin
by opensuse-security＠opensuse.org 06 Aug '19

06 Aug '19

openSUSE Security Update: Security update for spamassassin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1831-1 Rating: moderate References: #1069831 #1107765 #1108745 #1108748 #1108749 #1108750 #1115411 Cross-References: CVE-2016-1238 CVE-2017-15705 CVE-2018-11780 CVE-2018-11781 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves four vulnerabilities and has three fixes is now available. Description: This update for spamassassin to version 3.4.2 fixes the following issues: Security issues fixed: - CVE-2018-11781: Fixed an issue where a local user could inject code in the meta rule syntax (bsc#1108748). - CVE-2018-11780: Fixed a potential remote code execution vulnerability in the PDFInfo plugin (bsc#1108750). - CVE-2017-15705: Fixed a denial of service through unclosed tags in crafted emails (bsc#1108745). - CVE-2016-1238: Fixed an issue where perl would load modules from the current directory (bsc#1108749). Non-security issues fixed: - Use systemd timers instead of cron (bsc#1115411) - Fixed incompatibility with Net::DNS >= 1.01 (bsc#1107765) - Fixed warning about deprecated regex during sa-update (bsc#1069831) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1831=1 Package List: - openSUSE Leap 15.0 (x86_64): perl-Mail-SpamAssassin-3.4.2-lp150.6.3.1 perl-Mail-SpamAssassin-Plugin-iXhash2-2.05-lp150.6.3.1 spamassassin-3.4.2-lp150.6.3.1 spamassassin-debuginfo-3.4.2-lp150.6.3.1 spamassassin-debugsource-3.4.2-lp150.6.3.1 References: https://www.suse.com/security/cve/CVE-2016-1238.html https://www.suse.com/security/cve/CVE-2017-15705.html https://www.suse.com/security/cve/CVE-2018-11780.html https://www.suse.com/security/cve/CVE-2018-11781.html https://bugzilla.suse.com/1069831 https://bugzilla.suse.com/1107765 https://bugzilla.suse.com/1108745 https://bugzilla.suse.com/1108748 https://bugzilla.suse.com/1108749 https://bugzilla.suse.com/1108750 https://bugzilla.suse.com/1115411 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1824-1: important: Security update for rmt-server
by opensuse-security＠opensuse.org 01 Aug '19

01 Aug '19

openSUSE Security Update: Security update for rmt-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1824-1 Rating: important References: #1128858 #1129271 #1129392 #1132160 #1132690 #1134190 #1134428 #1135222 #1136020 #1136081 #1138316 #1140492 Cross-References: CVE-2019-11068 CVE-2019-5419 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has 10 fixes is now available. Description: This update for rmt-server to version 2.3.1 fixes the following issues: - Fix mirroring logic when errors are encountered (bsc#1140492) - Refactor RMT::Mirror to download metadata/licenses in parallel - Check repo metadata GPG signatures during mirroring (bsc#1132690) - Add rmt-server-config subpackage with nginx configs (fate#327816, bsc#1136081) - Fix dependency to removed boot_cli_i18n file (bsc#1136020) - Add `rmt-cli systems list` command to list registered systems - Fix create UUID when system_uuid file empty (bsc#1138316) - Fix duplicate nginx location in rmt-server-pubcloud (bsc#1135222) - Mirror additional repos that were enabled during mirroring (bsc#1132690) - Make service IDs consistent across different RMT instances (bsc#1134428) - Make SMT data import scripts faster (bsc#1134190) - Fix incorrect triggering of registration sharing (bsc#1129392) - Fix license mirroring issue in some non-SUSE repositories (bsc#1128858) - Update dependencies to fix vulnerabilities in rails (CVE-2019-5419, bsc#1129271) and nokogiri (CVE-2019-11068, bsc#1132160) - Allow RMT registration to work under HTTP as well as HTTPS. - Offline migration from SLE 15 to SLE 15 SP1 will add Python2 module - Online migrations will automatically add additional modules to the client systems depending on the base product - Supply log severity to journald - Breaking Change: Added headers to generated CSV files This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1824=1 Package List: - openSUSE Leap 15.1 (x86_64): rmt-server-2.3.1-lp151.2.3.1 rmt-server-config-2.3.1-lp151.2.3.1 rmt-server-debuginfo-2.3.1-lp151.2.3.1 rmt-server-debugsource-2.3.1-lp151.2.3.1 rmt-server-pubcloud-2.3.1-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-11068.html https://www.suse.com/security/cve/CVE-2019-5419.html https://bugzilla.suse.com/1128858 https://bugzilla.suse.com/1129271 https://bugzilla.suse.com/1129392 https://bugzilla.suse.com/1132160 https://bugzilla.suse.com/1132690 https://bugzilla.suse.com/1134190 https://bugzilla.suse.com/1134428 https://bugzilla.suse.com/1135222 https://bugzilla.suse.com/1136020 https://bugzilla.suse.com/1136081 https://bugzilla.suse.com/1138316 https://bugzilla.suse.com/1140492 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:1826-1: moderate: Security update for openexr
by opensuse-security＠opensuse.org 01 Aug '19

01 Aug '19

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1826-1 Rating: moderate References: #1040109 #1040113 #1040115 Cross-References: CVE-2017-9111 CVE-2017-9113 CVE-2017-9115 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for openexr fixes the following issues: Security issues fixed: - CVE-2017-9111: Fixed an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h (bsc#1040109). - CVE-2017-9113: Fixed an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp (bsc#1040113). - CVE-2017-9115: Fixed an invalid write of size 2 in the = operator function inhalf.h (bsc#1040115). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1826=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libIlmImf-2_2-23-2.2.1-lp151.4.3.1 libIlmImf-2_2-23-debuginfo-2.2.1-lp151.4.3.1 libIlmImfUtil-2_2-23-2.2.1-lp151.4.3.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-lp151.4.3.1 openexr-2.2.1-lp151.4.3.1 openexr-debuginfo-2.2.1-lp151.4.3.1 openexr-debugsource-2.2.1-lp151.4.3.1 openexr-devel-2.2.1-lp151.4.3.1 openexr-doc-2.2.1-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-lp151.4.3.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-lp151.4.3.1 libIlmImfUtil-2_2-23-32bit-2.2.1-lp151.4.3.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2017-9111.html https://www.suse.com/security/cve/CVE-2017-9113.html https://www.suse.com/security/cve/CVE-2017-9115.html https://bugzilla.suse.com/1040109 https://bugzilla.suse.com/1040113 https://bugzilla.suse.com/1040115 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0