September 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:2224-1: moderate: Security update for SDL2
by opensuse-security＠opensuse.org 30 Sep '19

30 Sep '19

openSUSE Security Update: Security update for SDL2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2224-1 Rating: moderate References: #1141844 #1142031 Cross-References: CVE-2019-13616 CVE-2019-13626 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for SDL2 fixes the following issues: Security issues fixed: - CVE-2019-13616: Fixed heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c (bsc#1141844). - CVE-2019-13626: Fixed integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c (bsc#1142031). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2224=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): SDL2-debugsource-2.0.8-lp150.2.9.1 libSDL2-2_0-0-2.0.8-lp150.2.9.1 libSDL2-2_0-0-debuginfo-2.0.8-lp150.2.9.1 libSDL2-devel-2.0.8-lp150.2.9.1 - openSUSE Leap 15.0 (x86_64): libSDL2-2_0-0-32bit-2.0.8-lp150.2.9.1 libSDL2-2_0-0-32bit-debuginfo-2.0.8-lp150.2.9.1 libSDL2-devel-32bit-2.0.8-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2019-13616.html https://www.suse.com/security/cve/CVE-2019-13626.html https://bugzilla.suse.com/1141844 https://bugzilla.suse.com/1142031 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2226-1: moderate: Security update for SDL2
by opensuse-security＠opensuse.org 30 Sep '19

30 Sep '19

openSUSE Security Update: Security update for SDL2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2226-1 Rating: moderate References: #1141844 #1142031 Cross-References: CVE-2019-13616 CVE-2019-13626 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for SDL2 fixes the following issues: Security issues fixed: - CVE-2019-13616: Fixed heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c (bsc#1141844). - CVE-2019-13626: Fixed integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c (bsc#1142031). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2226=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): SDL2-debugsource-2.0.8-lp151.4.6.1 libSDL2-2_0-0-2.0.8-lp151.4.6.1 libSDL2-2_0-0-debuginfo-2.0.8-lp151.4.6.1 libSDL2-devel-2.0.8-lp151.4.6.1 - openSUSE Leap 15.1 (x86_64): libSDL2-2_0-0-32bit-2.0.8-lp151.4.6.1 libSDL2-2_0-0-32bit-debuginfo-2.0.8-lp151.4.6.1 libSDL2-devel-32bit-2.0.8-lp151.4.6.1 References: https://www.suse.com/security/cve/CVE-2019-13616.html https://www.suse.com/security/cve/CVE-2019-13626.html https://bugzilla.suse.com/1141844 https://bugzilla.suse.com/1142031 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2225-1: moderate: Security update for python-numpy
by opensuse-security＠opensuse.org 30 Sep '19

30 Sep '19

openSUSE Security Update: Security update for python-numpy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2225-1 Rating: moderate References: #1149203 Cross-References: CVE-2019-6446 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-numpy fixes the following issues: Non-security issues fixed: - Updated to upstream version 1.16.1. (bsc#1149203) (jsc#SLE-8532) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2225=1 Package List: - openSUSE Leap 15.0 (x86_64): python-numpy-debuginfo-1.16.1-lp150.8.1 python-numpy-debugsource-1.16.1-lp150.8.1 python-numpy_1_16_1-gnu-hpc-debuginfo-1.16.1-lp150.8.1 python-numpy_1_16_1-gnu-hpc-debugsource-1.16.1-lp150.8.1 python2-numpy-1.16.1-lp150.8.1 python2-numpy-debuginfo-1.16.1-lp150.8.1 python2-numpy-devel-1.16.1-lp150.8.1 python2-numpy-gnu-hpc-1.16.1-lp150.8.1 python2-numpy-gnu-hpc-devel-1.16.1-lp150.8.1 python2-numpy_1_16_1-gnu-hpc-1.16.1-lp150.8.1 python2-numpy_1_16_1-gnu-hpc-debuginfo-1.16.1-lp150.8.1 python2-numpy_1_16_1-gnu-hpc-devel-1.16.1-lp150.8.1 python3-numpy-1.16.1-lp150.8.1 python3-numpy-debuginfo-1.16.1-lp150.8.1 python3-numpy-devel-1.16.1-lp150.8.1 python3-numpy-gnu-hpc-1.16.1-lp150.8.1 python3-numpy-gnu-hpc-devel-1.16.1-lp150.8.1 python3-numpy_1_16_1-gnu-hpc-1.16.1-lp150.8.1 python3-numpy_1_16_1-gnu-hpc-debuginfo-1.16.1-lp150.8.1 python3-numpy_1_16_1-gnu-hpc-devel-1.16.1-lp150.8.1 References: https://www.suse.com/security/cve/CVE-2019-6446.html https://bugzilla.suse.com/1149203 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2227-1: moderate: Security update for python-numpy
by opensuse-security＠opensuse.org 30 Sep '19

30 Sep '19

openSUSE Security Update: Security update for python-numpy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2227-1 Rating: moderate References: #1149203 Cross-References: CVE-2019-6446 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-numpy fixes the following issues: Non-security issues fixed: - Updated to upstream version 1.16.1. (bsc#1149203) (jsc#SLE-8532) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2227=1 Package List: - openSUSE Leap 15.1 (x86_64): python-numpy-debuginfo-1.16.1-lp151.5.3.1 python-numpy-debugsource-1.16.1-lp151.5.3.1 python-numpy_1_16_1-gnu-hpc-debuginfo-1.16.1-lp151.5.3.1 python-numpy_1_16_1-gnu-hpc-debugsource-1.16.1-lp151.5.3.1 python2-numpy-1.16.1-lp151.5.3.1 python2-numpy-debuginfo-1.16.1-lp151.5.3.1 python2-numpy-devel-1.16.1-lp151.5.3.1 python2-numpy-gnu-hpc-1.16.1-lp151.5.3.1 python2-numpy-gnu-hpc-devel-1.16.1-lp151.5.3.1 python2-numpy_1_16_1-gnu-hpc-1.16.1-lp151.5.3.1 python2-numpy_1_16_1-gnu-hpc-debuginfo-1.16.1-lp151.5.3.1 python2-numpy_1_16_1-gnu-hpc-devel-1.16.1-lp151.5.3.1 python3-numpy-1.16.1-lp151.5.3.1 python3-numpy-debuginfo-1.16.1-lp151.5.3.1 python3-numpy-devel-1.16.1-lp151.5.3.1 python3-numpy-gnu-hpc-1.16.1-lp151.5.3.1 python3-numpy-gnu-hpc-devel-1.16.1-lp151.5.3.1 python3-numpy_1_16_1-gnu-hpc-1.16.1-lp151.5.3.1 python3-numpy_1_16_1-gnu-hpc-debuginfo-1.16.1-lp151.5.3.1 python3-numpy_1_16_1-gnu-hpc-devel-1.16.1-lp151.5.3.1 References: https://www.suse.com/security/cve/CVE-2019-6446.html https://bugzilla.suse.com/1149203 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2222-1: important: Security update for ghostscript
by opensuse-security＠opensuse.org 30 Sep '19

30 Sep '19

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2222-1 Rating: important References: #1129180 #1129186 #1134156 #1140359 #1146882 #1146884 Cross-References: CVE-2019-12973 CVE-2019-14811 CVE-2019-14812 CVE-2019-14813 CVE-2019-14817 CVE-2019-3835 CVE-2019-3839 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for ghostscript fixes the following issues: Security issues fixed: - CVE-2019-3835: Fixed an unauthorized file system access caused by an available superexec operator. (bsc#1129180) - CVE-2019-3839: Fixed an unauthorized file system access caused by available privileged operators. (bsc#1134156) - CVE-2019-12973: Fixed a denial-of-service vulnerability in the OpenJPEG function opj_t1_encode_cblks. (bsc#1140359) - CVE-2019-14811: Fixed a safer mode bypass by .forceput exposure in .pdf_hook_DSC_Creator. (bsc#1146882) - CVE-2019-14812: Fixed a safer mode bypass by .forceput exposure in setuserparams. (bsc#1146882) - CVE-2019-14813: Fixed a safer mode bypass by .forceput exposure in setsystemparams. (bsc#1146882) - CVE-2019-14817: Fixed a safer mode bypass by .forceput exposure in .pdfexectoken and other procedures. (bsc#1146884) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2222=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): ghostscript-9.27-lp150.2.23.1 ghostscript-debuginfo-9.27-lp150.2.23.1 ghostscript-debugsource-9.27-lp150.2.23.1 ghostscript-devel-9.27-lp150.2.23.1 ghostscript-mini-9.27-lp150.2.23.1 ghostscript-mini-debuginfo-9.27-lp150.2.23.1 ghostscript-mini-debugsource-9.27-lp150.2.23.1 ghostscript-mini-devel-9.27-lp150.2.23.1 ghostscript-x11-9.27-lp150.2.23.1 ghostscript-x11-debuginfo-9.27-lp150.2.23.1 References: https://www.suse.com/security/cve/CVE-2019-12973.html https://www.suse.com/security/cve/CVE-2019-14811.html https://www.suse.com/security/cve/CVE-2019-14812.html https://www.suse.com/security/cve/CVE-2019-14813.html https://www.suse.com/security/cve/CVE-2019-14817.html https://www.suse.com/security/cve/CVE-2019-3835.html https://www.suse.com/security/cve/CVE-2019-3839.html https://bugzilla.suse.com/1129180 https://bugzilla.suse.com/1129186 https://bugzilla.suse.com/1134156 https://bugzilla.suse.com/1140359 https://bugzilla.suse.com/1146882 https://bugzilla.suse.com/1146884 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2221-1: moderate: Security update for varnish
by opensuse-security＠opensuse.org 30 Sep '19

30 Sep '19

openSUSE Security Update: Security update for varnish ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2221-1 Rating: moderate References: #1149382 Cross-References: CVE-2019-15892 Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for varnish fixes the following issues: Security issue fixed: - CVE-2019-15892: Fixed a potential denial of service by sending crafted HTTP/1 requests (boo#1149382). Non-security issues fixed: - Updated the package to release 6.2.1. - Added a thread pool watchdog which will restart the worker process if scheduling tasks onto worker threads appears stuck. The new parameter "thread_pool_watchdog" configures it. - Disabled error for clobbering, which caused bogus error in varnishtest. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2221=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2221=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libvarnishapi2-6.2.1-bp151.4.3.1 libvarnishapi2-debuginfo-6.2.1-bp151.4.3.1 varnish-6.2.1-bp151.4.3.1 varnish-debuginfo-6.2.1-bp151.4.3.1 varnish-debugsource-6.2.1-bp151.4.3.1 varnish-devel-6.2.1-bp151.4.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libvarnishapi2-6.2.1-bp150.3.3.1 varnish-6.2.1-bp150.3.3.1 varnish-devel-6.2.1-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-15892.html https://bugzilla.suse.com/1149382 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2223-1: important: Security update for ghostscript
by opensuse-security＠opensuse.org 30 Sep '19

30 Sep '19

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2223-1 Rating: important References: #1129180 #1129186 #1134156 #1140359 #1146882 #1146884 Cross-References: CVE-2019-12973 CVE-2019-14811 CVE-2019-14812 CVE-2019-14813 CVE-2019-14817 CVE-2019-3835 CVE-2019-3839 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for ghostscript fixes the following issues: Security issues fixed: - CVE-2019-3835: Fixed an unauthorized file system access caused by an available superexec operator. (bsc#1129180) - CVE-2019-3839: Fixed an unauthorized file system access caused by available privileged operators. (bsc#1134156) - CVE-2019-12973: Fixed a denial-of-service vulnerability in the OpenJPEG function opj_t1_encode_cblks. (bsc#1140359) - CVE-2019-14811: Fixed a safer mode bypass by .forceput exposure in .pdf_hook_DSC_Creator. (bsc#1146882) - CVE-2019-14812: Fixed a safer mode bypass by .forceput exposure in setuserparams. (bsc#1146882) - CVE-2019-14813: Fixed a safer mode bypass by .forceput exposure in setsystemparams. (bsc#1146882) - CVE-2019-14817: Fixed a safer mode bypass by .forceput exposure in .pdfexectoken and other procedures. (bsc#1146884) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2223=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ghostscript-9.27-lp151.3.6.1 ghostscript-debuginfo-9.27-lp151.3.6.1 ghostscript-debugsource-9.27-lp151.3.6.1 ghostscript-devel-9.27-lp151.3.6.1 ghostscript-mini-9.27-lp151.3.6.1 ghostscript-mini-debuginfo-9.27-lp151.3.6.1 ghostscript-mini-debugsource-9.27-lp151.3.6.1 ghostscript-mini-devel-9.27-lp151.3.6.1 ghostscript-x11-9.27-lp151.3.6.1 ghostscript-x11-debuginfo-9.27-lp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-12973.html https://www.suse.com/security/cve/CVE-2019-14811.html https://www.suse.com/security/cve/CVE-2019-14812.html https://www.suse.com/security/cve/CVE-2019-14813.html https://www.suse.com/security/cve/CVE-2019-14817.html https://www.suse.com/security/cve/CVE-2019-3835.html https://www.suse.com/security/cve/CVE-2019-3839.html https://bugzilla.suse.com/1129180 https://bugzilla.suse.com/1129186 https://bugzilla.suse.com/1134156 https://bugzilla.suse.com/1140359 https://bugzilla.suse.com/1146882 https://bugzilla.suse.com/1146884 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2219-1: moderate: Security update for djvulibre
by opensuse-security＠opensuse.org 30 Sep '19

30 Sep '19

openSUSE Security Update: Security update for djvulibre ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2219-1 Rating: moderate References: #1146569 #1146571 #1146572 #1146702 Cross-References: CVE-2019-15142 CVE-2019-15143 CVE-2019-15144 CVE-2019-15145 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for djvulibre fixes the following issues: Security issues fixed: - CVE-2019-15142: Fixed heap-based buffer over-read (bsc#1146702). - CVE-2019-15143: Fixed resource exhaustion caused by corrupted image files (bsc#1146569). - CVE-2019-15144: Fixed denial-of-service caused by crafted PBM image files (bsc#1146571). - CVE-2019-15145: Fixed out-of-bounds read caused by corrupted JB2 image files (bsc#1146572). - Fixed segfault when libtiff encounters corrupted TIFF (upstream issue #295). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2219=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): djvulibre-3.5.27-lp151.3.3.1 djvulibre-debuginfo-3.5.27-lp151.3.3.1 djvulibre-debugsource-3.5.27-lp151.3.3.1 djvulibre-doc-3.5.27-lp151.3.3.1 libdjvulibre-devel-3.5.27-lp151.3.3.1 libdjvulibre21-3.5.27-lp151.3.3.1 libdjvulibre21-debuginfo-3.5.27-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-15142.html https://www.suse.com/security/cve/CVE-2019-15143.html https://www.suse.com/security/cve/CVE-2019-15144.html https://www.suse.com/security/cve/CVE-2019-15145.html https://bugzilla.suse.com/1146569 https://bugzilla.suse.com/1146571 https://bugzilla.suse.com/1146572 https://bugzilla.suse.com/1146702 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2217-1: moderate: Security update for djvulibre
by opensuse-security＠opensuse.org 30 Sep '19

30 Sep '19

openSUSE Security Update: Security update for djvulibre ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2217-1 Rating: moderate References: #1146569 #1146571 #1146572 #1146702 Cross-References: CVE-2019-15142 CVE-2019-15143 CVE-2019-15144 CVE-2019-15145 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for djvulibre fixes the following issues: Security issues fixed: - CVE-2019-15142: Fixed heap-based buffer over-read (bsc#1146702). - CVE-2019-15143: Fixed resource exhaustion caused by corrupted image files (bsc#1146569). - CVE-2019-15144: Fixed denial-of-service caused by crafted PBM image files (bsc#1146571). - CVE-2019-15145: Fixed out-of-bounds read caused by corrupted JB2 image files (bsc#1146572). - Fixed segfault when libtiff encounters corrupted TIFF (upstream issue #295). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2217=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): djvulibre-3.5.27-lp150.2.3.1 djvulibre-debuginfo-3.5.27-lp150.2.3.1 djvulibre-debugsource-3.5.27-lp150.2.3.1 djvulibre-doc-3.5.27-lp150.2.3.1 libdjvulibre-devel-3.5.27-lp150.2.3.1 libdjvulibre21-3.5.27-lp150.2.3.1 libdjvulibre21-debuginfo-3.5.27-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-15142.html https://www.suse.com/security/cve/CVE-2019-15143.html https://www.suse.com/security/cve/CVE-2019-15144.html https://www.suse.com/security/cve/CVE-2019-15145.html https://bugzilla.suse.com/1146569 https://bugzilla.suse.com/1146571 https://bugzilla.suse.com/1146572 https://bugzilla.suse.com/1146702 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2212-1: moderate: Security update for libopenmpt
by opensuse-security＠opensuse.org 28 Sep '19

28 Sep '19

openSUSE Security Update: Security update for libopenmpt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2212-1 Rating: moderate References: #1143578 #1143581 #1143582 #1143584 Cross-References: CVE-2018-20860 CVE-2018-20861 CVE-2019-14382 CVE-2019-14383 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libopenmpt fixes the following issues: Security issues fixed: - CVE-2018-20861: Fixed crash with certain malformed custom tunings in MPTM files (bsc#1143578). - CVE-2018-20860: Fixed crash with malformed MED files (bsc#1143581). - CVE-2019-14383: Fixed J2B that allows an assertion failure during file parsing with debug STLs (bsc#1143584). - CVE-2019-14382: Fixed DSM that allows an assertion failure during file parsing with debug STLs (bsc#1143582). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2212=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libmodplug-devel-0.3.17-lp150.7.1 libmodplug1-0.3.17-lp150.7.1 libmodplug1-debuginfo-0.3.17-lp150.7.1 libopenmpt-debugsource-0.3.17-lp150.7.1 libopenmpt-devel-0.3.17-lp150.7.1 libopenmpt0-0.3.17-lp150.7.1 libopenmpt0-debuginfo-0.3.17-lp150.7.1 libopenmpt_modplug1-0.3.17-lp150.7.1 libopenmpt_modplug1-debuginfo-0.3.17-lp150.7.1 openmpt123-0.3.17-lp150.7.1 openmpt123-debuginfo-0.3.17-lp150.7.1 - openSUSE Leap 15.0 (x86_64): libmodplug1-32bit-0.3.17-lp150.7.1 libmodplug1-32bit-debuginfo-0.3.17-lp150.7.1 libopenmpt0-32bit-0.3.17-lp150.7.1 libopenmpt0-32bit-debuginfo-0.3.17-lp150.7.1 libopenmpt_modplug1-32bit-0.3.17-lp150.7.1 libopenmpt_modplug1-32bit-debuginfo-0.3.17-lp150.7.1 References: https://www.suse.com/security/cve/CVE-2018-20860.html https://www.suse.com/security/cve/CVE-2018-20861.html https://www.suse.com/security/cve/CVE-2019-14382.html https://www.suse.com/security/cve/CVE-2019-14383.html https://bugzilla.suse.com/1143578 https://bugzilla.suse.com/1143581 https://bugzilla.suse.com/1143582 https://bugzilla.suse.com/1143584 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2213-1: moderate: Security update for libopenmpt
by opensuse-security＠opensuse.org 28 Sep '19

28 Sep '19

openSUSE Security Update: Security update for libopenmpt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2213-1 Rating: moderate References: #1143578 #1143581 #1143582 #1143584 Cross-References: CVE-2018-20860 CVE-2018-20861 CVE-2019-14382 CVE-2019-14383 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libopenmpt fixes the following issues: Security issues fixed: - CVE-2018-20861: Fixed crash with certain malformed custom tunings in MPTM files (bsc#1143578). - CVE-2018-20860: Fixed crash with malformed MED files (bsc#1143581). - CVE-2019-14383: Fixed J2B that allows an assertion failure during file parsing with debug STLs (bsc#1143584). - CVE-2019-14382: Fixed DSM that allows an assertion failure during file parsing with debug STLs (bsc#1143582). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2213=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libmodplug-devel-0.3.17-lp151.2.3.1 libmodplug1-0.3.17-lp151.2.3.1 libmodplug1-debuginfo-0.3.17-lp151.2.3.1 libopenmpt-debugsource-0.3.17-lp151.2.3.1 libopenmpt-devel-0.3.17-lp151.2.3.1 libopenmpt0-0.3.17-lp151.2.3.1 libopenmpt0-debuginfo-0.3.17-lp151.2.3.1 libopenmpt_modplug1-0.3.17-lp151.2.3.1 libopenmpt_modplug1-debuginfo-0.3.17-lp151.2.3.1 openmpt123-0.3.17-lp151.2.3.1 openmpt123-debuginfo-0.3.17-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): libmodplug1-32bit-0.3.17-lp151.2.3.1 libmodplug1-32bit-debuginfo-0.3.17-lp151.2.3.1 libopenmpt0-32bit-0.3.17-lp151.2.3.1 libopenmpt0-32bit-debuginfo-0.3.17-lp151.2.3.1 libopenmpt_modplug1-32bit-0.3.17-lp151.2.3.1 libopenmpt_modplug1-32bit-debuginfo-0.3.17-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-20860.html https://www.suse.com/security/cve/CVE-2018-20861.html https://www.suse.com/security/cve/CVE-2019-14382.html https://www.suse.com/security/cve/CVE-2019-14383.html https://bugzilla.suse.com/1143578 https://bugzilla.suse.com/1143581 https://bugzilla.suse.com/1143582 https://bugzilla.suse.com/1143584 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2207-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 28 Sep '19

28 Sep '19

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2207-1 Rating: important References: #1148931 Cross-References: CVE-2019-8595 CVE-2019-8607 CVE-2019-8615 CVE-2019-8644 CVE-2019-8649 CVE-2019-8658 CVE-2019-8666 CVE-2019-8669 CVE-2019-8671 CVE-2019-8672 CVE-2019-8673 CVE-2019-8676 CVE-2019-8677 CVE-2019-8678 CVE-2019-8679 CVE-2019-8680 CVE-2019-8681 CVE-2019-8683 CVE-2019-8684 CVE-2019-8686 CVE-2019-8687 CVE-2019-8688 CVE-2019-8689 CVE-2019-8690 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: This update for webkit2gtk3 fixes the following issues: Security issues fixed: - CVE-2019-8673, CVE-2019-8678, CVE-2019-8686, CVE-2019-8683, CVE-2019-8671, CVE-2019-8595, CVE-2019-8684, CVE-2019-8681, CVE-2019-8615, CVE-2019-8689, CVE-2019-8680, CVE-2019-8672, CVE-2019-8676, CVE-2019-8666, CVE-2019-8644, CVE-2019-8658, CVE-2019-8690, CVE-2019-8688, CVE-2019-8649, CVE-2019-8679, CVE-2019-8687, CVE-2019-8669, CVE-2019-8677, CVE-2019-8607 (bsc#1148931). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2207=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.24.4-lp150.2.25.1 libjavascriptcoregtk-4_0-18-debuginfo-2.24.4-lp150.2.25.1 libwebkit2gtk-4_0-37-2.24.4-lp150.2.25.1 libwebkit2gtk-4_0-37-debuginfo-2.24.4-lp150.2.25.1 typelib-1_0-JavaScriptCore-4_0-2.24.4-lp150.2.25.1 typelib-1_0-WebKit2-4_0-2.24.4-lp150.2.25.1 typelib-1_0-WebKit2WebExtension-4_0-2.24.4-lp150.2.25.1 webkit-jsc-4-2.24.4-lp150.2.25.1 webkit-jsc-4-debuginfo-2.24.4-lp150.2.25.1 webkit2gtk-4_0-injected-bundles-2.24.4-lp150.2.25.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.24.4-lp150.2.25.1 webkit2gtk3-debugsource-2.24.4-lp150.2.25.1 webkit2gtk3-devel-2.24.4-lp150.2.25.1 webkit2gtk3-minibrowser-2.24.4-lp150.2.25.1 webkit2gtk3-minibrowser-debuginfo-2.24.4-lp150.2.25.1 webkit2gtk3-plugin-process-gtk2-2.24.4-lp150.2.25.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.24.4-lp150.2.25.1 - openSUSE Leap 15.0 (noarch): libwebkit2gtk3-lang-2.24.4-lp150.2.25.1 - openSUSE Leap 15.0 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.24.4-lp150.2.25.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.24.4-lp150.2.25.1 libwebkit2gtk-4_0-37-32bit-2.24.4-lp150.2.25.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.24.4-lp150.2.25.1 References: https://www.suse.com/security/cve/CVE-2019-8595.html https://www.suse.com/security/cve/CVE-2019-8607.html https://www.suse.com/security/cve/CVE-2019-8615.html https://www.suse.com/security/cve/CVE-2019-8644.html https://www.suse.com/security/cve/CVE-2019-8649.html https://www.suse.com/security/cve/CVE-2019-8658.html https://www.suse.com/security/cve/CVE-2019-8666.html https://www.suse.com/security/cve/CVE-2019-8669.html https://www.suse.com/security/cve/CVE-2019-8671.html https://www.suse.com/security/cve/CVE-2019-8672.html https://www.suse.com/security/cve/CVE-2019-8673.html https://www.suse.com/security/cve/CVE-2019-8676.html https://www.suse.com/security/cve/CVE-2019-8677.html https://www.suse.com/security/cve/CVE-2019-8678.html https://www.suse.com/security/cve/CVE-2019-8679.html https://www.suse.com/security/cve/CVE-2019-8680.html https://www.suse.com/security/cve/CVE-2019-8681.html https://www.suse.com/security/cve/CVE-2019-8683.html https://www.suse.com/security/cve/CVE-2019-8684.html https://www.suse.com/security/cve/CVE-2019-8686.html https://www.suse.com/security/cve/CVE-2019-8687.html https://www.suse.com/security/cve/CVE-2019-8688.html https://www.suse.com/security/cve/CVE-2019-8689.html https://www.suse.com/security/cve/CVE-2019-8690.html https://bugzilla.suse.com/1148931 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2208-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 28 Sep '19

28 Sep '19

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2208-1 Rating: important References: #1148931 Cross-References: CVE-2019-8595 CVE-2019-8607 CVE-2019-8615 CVE-2019-8644 CVE-2019-8649 CVE-2019-8658 CVE-2019-8666 CVE-2019-8669 CVE-2019-8671 CVE-2019-8672 CVE-2019-8673 CVE-2019-8676 CVE-2019-8677 CVE-2019-8678 CVE-2019-8679 CVE-2019-8680 CVE-2019-8681 CVE-2019-8683 CVE-2019-8684 CVE-2019-8686 CVE-2019-8687 CVE-2019-8688 CVE-2019-8689 CVE-2019-8690 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: This update for webkit2gtk3 fixes the following issues: Security issues fixed: - CVE-2019-8673, CVE-2019-8678, CVE-2019-8686, CVE-2019-8683, CVE-2019-8671, CVE-2019-8595, CVE-2019-8684, CVE-2019-8681, CVE-2019-8615, CVE-2019-8689, CVE-2019-8680, CVE-2019-8672, CVE-2019-8676, CVE-2019-8666, CVE-2019-8644, CVE-2019-8658, CVE-2019-8690, CVE-2019-8688, CVE-2019-8649, CVE-2019-8679, CVE-2019-8687, CVE-2019-8669, CVE-2019-8677, CVE-2019-8607 (bsc#1148931). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2208=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.24.4-lp151.2.6.1 libjavascriptcoregtk-4_0-18-debuginfo-2.24.4-lp151.2.6.1 libwebkit2gtk-4_0-37-2.24.4-lp151.2.6.1 libwebkit2gtk-4_0-37-debuginfo-2.24.4-lp151.2.6.1 typelib-1_0-JavaScriptCore-4_0-2.24.4-lp151.2.6.1 typelib-1_0-WebKit2-4_0-2.24.4-lp151.2.6.1 typelib-1_0-WebKit2WebExtension-4_0-2.24.4-lp151.2.6.1 webkit-jsc-4-2.24.4-lp151.2.6.1 webkit-jsc-4-debuginfo-2.24.4-lp151.2.6.1 webkit2gtk-4_0-injected-bundles-2.24.4-lp151.2.6.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.24.4-lp151.2.6.1 webkit2gtk3-debugsource-2.24.4-lp151.2.6.1 webkit2gtk3-devel-2.24.4-lp151.2.6.1 webkit2gtk3-minibrowser-2.24.4-lp151.2.6.1 webkit2gtk3-minibrowser-debuginfo-2.24.4-lp151.2.6.1 webkit2gtk3-plugin-process-gtk2-2.24.4-lp151.2.6.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.24.4-lp151.2.6.1 - openSUSE Leap 15.1 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.24.4-lp151.2.6.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.24.4-lp151.2.6.1 libwebkit2gtk-4_0-37-32bit-2.24.4-lp151.2.6.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.24.4-lp151.2.6.1 - openSUSE Leap 15.1 (noarch): libwebkit2gtk3-lang-2.24.4-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-8595.html https://www.suse.com/security/cve/CVE-2019-8607.html https://www.suse.com/security/cve/CVE-2019-8615.html https://www.suse.com/security/cve/CVE-2019-8644.html https://www.suse.com/security/cve/CVE-2019-8649.html https://www.suse.com/security/cve/CVE-2019-8658.html https://www.suse.com/security/cve/CVE-2019-8666.html https://www.suse.com/security/cve/CVE-2019-8669.html https://www.suse.com/security/cve/CVE-2019-8671.html https://www.suse.com/security/cve/CVE-2019-8672.html https://www.suse.com/security/cve/CVE-2019-8673.html https://www.suse.com/security/cve/CVE-2019-8676.html https://www.suse.com/security/cve/CVE-2019-8677.html https://www.suse.com/security/cve/CVE-2019-8678.html https://www.suse.com/security/cve/CVE-2019-8679.html https://www.suse.com/security/cve/CVE-2019-8680.html https://www.suse.com/security/cve/CVE-2019-8681.html https://www.suse.com/security/cve/CVE-2019-8683.html https://www.suse.com/security/cve/CVE-2019-8684.html https://www.suse.com/security/cve/CVE-2019-8686.html https://www.suse.com/security/cve/CVE-2019-8687.html https://www.suse.com/security/cve/CVE-2019-8688.html https://www.suse.com/security/cve/CVE-2019-8689.html https://www.suse.com/security/cve/CVE-2019-8690.html https://bugzilla.suse.com/1148931 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2205-1: moderate: Security update for expat
by opensuse-security＠opensuse.org 28 Sep '19

28 Sep '19

openSUSE Security Update: Security update for expat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2205-1 Rating: moderate References: #1149429 Cross-References: CVE-2019-15903 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for expat fixes the following issues: Security issues fixed: - CVE-2019-15903: Fixed heap-based buffer over-read caused by crafted XML input. (bsc#1149429) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2205=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): expat-2.2.5-lp151.3.6.1 expat-debuginfo-2.2.5-lp151.3.6.1 expat-debugsource-2.2.5-lp151.3.6.1 libexpat-devel-2.2.5-lp151.3.6.1 libexpat1-2.2.5-lp151.3.6.1 libexpat1-debuginfo-2.2.5-lp151.3.6.1 - openSUSE Leap 15.1 (x86_64): expat-32bit-debuginfo-2.2.5-lp151.3.6.1 libexpat-devel-32bit-2.2.5-lp151.3.6.1 libexpat1-32bit-2.2.5-lp151.3.6.1 libexpat1-32bit-debuginfo-2.2.5-lp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-15903.html https://bugzilla.suse.com/1149429 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2204-1: moderate: Security update for expat
by opensuse-security＠opensuse.org 28 Sep '19

28 Sep '19

openSUSE Security Update: Security update for expat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2204-1 Rating: moderate References: #1149429 Cross-References: CVE-2019-15903 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for expat fixes the following issues: Security issues fixed: - CVE-2019-15903: Fixed heap-based buffer over-read caused by crafted XML input. (bsc#1149429) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2204=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): expat-2.2.5-lp150.2.6.1 expat-debuginfo-2.2.5-lp150.2.6.1 expat-debugsource-2.2.5-lp150.2.6.1 libexpat-devel-2.2.5-lp150.2.6.1 libexpat1-2.2.5-lp150.2.6.1 libexpat1-debuginfo-2.2.5-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): expat-32bit-debuginfo-2.2.5-lp150.2.6.1 libexpat-devel-32bit-2.2.5-lp150.2.6.1 libexpat1-32bit-2.2.5-lp150.2.6.1 libexpat1-32bit-debuginfo-2.2.5-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-15903.html https://bugzilla.suse.com/1149429 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2211-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 28 Sep '19

28 Sep '19

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2211-1 Rating: moderate References: #1150914 Cross-References: CVE-2019-12922 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for phpMyAdmin to 4.9.1 fixes the following issues: Security issue fixed: - CVE-2019-12922: Fixed CSRF issue that allowed deletion of any server in the Setup page. (boo#1150914) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2211=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2211=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2211=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2211=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-2211=1 Package List: - openSUSE Leap 15.1 (noarch): phpMyAdmin-4.9.1-lp151.2.6.1 - openSUSE Leap 15.0 (noarch): phpMyAdmin-4.9.1-lp150.34.1 - openSUSE Backports SLE-15-SP1 (noarch): phpMyAdmin-4.9.1-bp151.3.6.1 - openSUSE Backports SLE-15 (noarch): phpMyAdmin-4.9.1-bp150.34.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.9.1-34.1 References: https://www.suse.com/security/cve/CVE-2019-12922.html https://bugzilla.suse.com/1150914 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2211-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 28 Sep '19

28 Sep '19

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2211-1 Rating: moderate References: #1150914 Cross-References: CVE-2019-12922 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for phpMyAdmin to 4.9.1 fixes the following issues: Security issue fixed: - CVE-2019-12922: Fixed CSRF issue that allowed deletion of any server in the Setup page. (boo#1150914) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-2211=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.9.1-34.1 References: https://www.suse.com/security/cve/CVE-2019-12922.html https://bugzilla.suse.com/1150914 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2206-1: moderate: Security update for mosquitto
by opensuse-security＠opensuse.org 28 Sep '19

28 Sep '19

openSUSE Security Update: Security update for mosquitto ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2206-1 Rating: moderate References: #1151494 Cross-References: CVE-2019-11779 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mosquitto fixes the following issues: - CVE-2019-11779: Fixed insufficient parsing of SUBSCRIBE packets that could lead to a stack overflow (bsc#1151494). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2206=1 Package List: - openSUSE Leap 15.1 (x86_64): libmosquitto1-1.5.7-lp151.2.3.1 libmosquitto1-debuginfo-1.5.7-lp151.2.3.1 libmosquittopp1-1.5.7-lp151.2.3.1 libmosquittopp1-debuginfo-1.5.7-lp151.2.3.1 mosquitto-1.5.7-lp151.2.3.1 mosquitto-clients-1.5.7-lp151.2.3.1 mosquitto-clients-debuginfo-1.5.7-lp151.2.3.1 mosquitto-debuginfo-1.5.7-lp151.2.3.1 mosquitto-debugsource-1.5.7-lp151.2.3.1 mosquitto-devel-1.5.7-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-11779.html https://bugzilla.suse.com/1151494 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2203-1: moderate: Security update for rust
by opensuse-security＠opensuse.org 27 Sep '19

27 Sep '19

openSUSE Security Update: Security update for rust ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2203-1 Rating: moderate References: #1096945 #1100691 #1133283 #1134978 Cross-References: CVE-2018-1000622 CVE-2019-12083 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for rust fixes the following issues: Rust was updated to version 1.36.0. Security issues fixed: - CVE-2019-12083: a standard method can be overridden violating Rust's safety guarantees and causing memory unsafety (bsc#1134978) - CVE-2018-1000622: rustdoc loads plugins from world writable directory allowing for arbitrary code execution (bsc#1100691) This update was imported from SUSE:SLE-15:Update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2203=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): cargo-1.36.0-lp151.5.4.1 clippy-1.36.0-lp151.5.4.1 rls-1.36.0-lp151.5.4.1 rust-1.36.0-lp151.5.4.1 rust-analysis-1.36.0-lp151.5.4.1 rust-doc-1.36.0-lp151.5.4.1 rust-gdb-1.36.0-lp151.5.4.1 rust-std-static-1.36.0-lp151.5.4.1 rustfmt-1.36.0-lp151.5.4.1 - openSUSE Leap 15.1 (noarch): cargo-doc-1.36.0-lp151.5.4.1 rust-src-1.36.0-lp151.5.4.1 - openSUSE Leap 15.1 (x86_64): rust-cbindgen-0.8.7-lp151.2.2 rust-cbindgen-debuginfo-0.8.7-lp151.2.2 References: https://www.suse.com/security/cve/CVE-2018-1000622.html https://www.suse.com/security/cve/CVE-2019-12083.html https://bugzilla.suse.com/1096945 https://bugzilla.suse.com/1100691 https://bugzilla.suse.com/1133283 https://bugzilla.suse.com/1134978 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2200-1: important: Security update for nmap
by opensuse-security＠opensuse.org 26 Sep '19

26 Sep '19

openSUSE Security Update: Security update for nmap ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2200-1 Rating: important References: #1135350 #1148742 Cross-References: CVE-2017-18594 CVE-2018-15173 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for nmap fixes the following issues: Security issue fixed: - CVE-2017-18594: Fixed a denial of service condition due to a double free when an SSH connection fails. (bsc#1148742) Non-security issue fixed: - Fixed a regression in the version scanner caused, by the fix for CVE-2018-15173. (bsc#1135350) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2200=1 Package List: - openSUSE Leap 15.1 (x86_64): ncat-7.70-lp151.3.9.1 ncat-debuginfo-7.70-lp151.3.9.1 ndiff-7.70-lp151.3.9.1 nmap-7.70-lp151.3.9.1 nmap-debuginfo-7.70-lp151.3.9.1 nmap-debugsource-7.70-lp151.3.9.1 nping-7.70-lp151.3.9.1 nping-debuginfo-7.70-lp151.3.9.1 zenmap-7.70-lp151.3.9.1 References: https://www.suse.com/security/cve/CVE-2017-18594.html https://www.suse.com/security/cve/CVE-2018-15173.html https://bugzilla.suse.com/1135350 https://bugzilla.suse.com/1148742 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2199-1: important: Security update for ibus
by opensuse-security＠opensuse.org 26 Sep '19

26 Sep '19

openSUSE Security Update: Security update for ibus ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2199-1 Rating: important References: #1150011 Cross-References: CVE-2019-14822 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ibus fixes the following issues: - CVE-2019-14822: Fixed misconfiguration of the DBus server allows to unprivileged user could monitor and send method calls to the ibus bus of another user (bsc#1150011). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2199=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ibus-1.5.19-lp151.2.3.1 ibus-debuginfo-1.5.19-lp151.2.3.1 ibus-debugsource-1.5.19-lp151.2.3.1 ibus-devel-1.5.19-lp151.2.3.1 ibus-gtk-1.5.19-lp151.2.3.1 ibus-gtk-debuginfo-1.5.19-lp151.2.3.1 ibus-gtk3-1.5.19-lp151.2.3.1 ibus-gtk3-debuginfo-1.5.19-lp151.2.3.1 libibus-1_0-5-1.5.19-lp151.2.3.1 libibus-1_0-5-debuginfo-1.5.19-lp151.2.3.1 typelib-1_0-IBus-1_0-1.5.19-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): ibus-gtk-32bit-1.5.19-lp151.2.3.1 ibus-gtk-32bit-debuginfo-1.5.19-lp151.2.3.1 ibus-gtk3-32bit-1.5.19-lp151.2.3.1 ibus-gtk3-32bit-debuginfo-1.5.19-lp151.2.3.1 libibus-1_0-5-32bit-1.5.19-lp151.2.3.1 libibus-1_0-5-32bit-debuginfo-1.5.19-lp151.2.3.1 python-ibus-1.5.19-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): ibus-lang-1.5.19-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-14822.html https://bugzilla.suse.com/1150011 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2198-1: important: Security update for nmap
by opensuse-security＠opensuse.org 26 Sep '19

26 Sep '19

openSUSE Security Update: Security update for nmap ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2198-1 Rating: important References: #1135350 #1148742 Cross-References: CVE-2017-18594 CVE-2018-15173 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for nmap fixes the following issues: Security issue fixed: - CVE-2017-18594: Fixed a denial of service condition due to a double free when an SSH connection fails. (bsc#1148742) Non-security issue fixed: - Fixed a regression in the version scanner caused, by the fix for CVE-2018-15173. (bsc#1135350) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2198=1 Package List: - openSUSE Leap 15.0 (x86_64): ncat-7.70-lp150.2.9.1 ncat-debuginfo-7.70-lp150.2.9.1 ndiff-7.70-lp150.2.9.1 nmap-7.70-lp150.2.9.1 nmap-debuginfo-7.70-lp150.2.9.1 nmap-debugsource-7.70-lp150.2.9.1 nping-7.70-lp150.2.9.1 nping-debuginfo-7.70-lp150.2.9.1 zenmap-7.70-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2017-18594.html https://www.suse.com/security/cve/CVE-2018-15173.html https://bugzilla.suse.com/1135350 https://bugzilla.suse.com/1148742 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2189-1: moderate: Security update for openssl-1_1
by opensuse-security＠opensuse.org 25 Sep '19

25 Sep '19

openSUSE Security Update: Security update for openssl-1_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2189-1 Rating: moderate References: #1150003 #1150250 Cross-References: CVE-2019-1547 CVE-2019-1563 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openssl-1_1 fixes the following issues: OpenSSL Security Advisory [10 September 2019] * CVE-2019-1547: Added EC_GROUP_set_generator side channel attack avoidance. (bsc#1150003) * CVE-2019-1563: Fixed Bleichenbacher attack against cms/pkcs7 encryption transported key (bsc#1150250) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2189=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libopenssl-1_1-devel-1.1.0i-lp150.3.25.1 libopenssl1_1-1.1.0i-lp150.3.25.1 libopenssl1_1-debuginfo-1.1.0i-lp150.3.25.1 libopenssl1_1-hmac-1.1.0i-lp150.3.25.1 openssl-1_1-1.1.0i-lp150.3.25.1 openssl-1_1-debuginfo-1.1.0i-lp150.3.25.1 openssl-1_1-debugsource-1.1.0i-lp150.3.25.1 - openSUSE Leap 15.0 (noarch): openssl-1_1-doc-1.1.0i-lp150.3.25.1 - openSUSE Leap 15.0 (x86_64): libopenssl-1_1-devel-32bit-1.1.0i-lp150.3.25.1 libopenssl1_1-32bit-1.1.0i-lp150.3.25.1 libopenssl1_1-32bit-debuginfo-1.1.0i-lp150.3.25.1 libopenssl1_1-hmac-32bit-1.1.0i-lp150.3.25.1 References: https://www.suse.com/security/cve/CVE-2019-1547.html https://www.suse.com/security/cve/CVE-2019-1563.html https://bugzilla.suse.com/1150003 https://bugzilla.suse.com/1150250 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2188-1: moderate: Security update for fish3
by opensuse-security＠opensuse.org 25 Sep '19

25 Sep '19

openSUSE Security Update: Security update for fish3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2188-1 Rating: moderate References: Cross-References: CVE-2014-2905 CVE-2014-2906 CVE-2014-2914 CVE-2014-3219 CVE-2014-3856 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update includes fish3 into the openSUSE Leap 15.1 distribution. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2188=1 Package List: - openSUSE Leap 15.1 (x86_64): fish3-3.0.0-lp151.2.1 fish3-debuginfo-3.0.0-lp151.2.1 fish3-debugsource-3.0.0-lp151.2.1 fish3-devel-3.0.0-lp151.2.1 References: https://www.suse.com/security/cve/CVE-2014-2905.html https://www.suse.com/security/cve/CVE-2014-2906.html https://www.suse.com/security/cve/CVE-2014-2914.html https://www.suse.com/security/cve/CVE-2014-3219.html https://www.suse.com/security/cve/CVE-2014-3856.html -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2186-1: important: Security update for chromium
by opensuse-security＠opensuse.org 25 Sep '19

25 Sep '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2186-1 Rating: important References: #1151229 Cross-References: CVE-2019-13685 CVE-2019-13686 CVE-2019-13687 CVE-2019-13688 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for chromium to version 77.0.3865.90 fixes the following issues: - CVE-2019-13685: Fixed a use-after-free in UI. (boo#1151229) - CVE-2019-13688: Fixed a use-after-free in media. (boo#1151229) - CVE-2019-13687: Fixed a use-after-free in media. (boo#1151229) - CVE-2019-13686: Fixed a use-after-free in offline pages. (boo#1151229) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2186=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2186=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-77.0.3865.90-lp151.2.33.1 chromedriver-debuginfo-77.0.3865.90-lp151.2.33.1 chromium-77.0.3865.90-lp151.2.33.1 chromium-debuginfo-77.0.3865.90-lp151.2.33.1 chromium-debugsource-77.0.3865.90-lp151.2.33.1 - openSUSE Leap 15.0 (x86_64): chromedriver-77.0.3865.90-lp150.242.1 chromedriver-debuginfo-77.0.3865.90-lp150.242.1 chromium-77.0.3865.90-lp150.242.1 chromium-debuginfo-77.0.3865.90-lp150.242.1 chromium-debugsource-77.0.3865.90-lp150.242.1 References: https://www.suse.com/security/cve/CVE-2019-13685.html https://www.suse.com/security/cve/CVE-2019-13686.html https://www.suse.com/security/cve/CVE-2019-13687.html https://www.suse.com/security/cve/CVE-2019-13688.html https://bugzilla.suse.com/1151229 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0