September 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:2139-1: moderate: Security update for ghostscript
by opensuse-security＠opensuse.org 16 Sep '19

16 Sep '19

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2139-1 Rating: moderate References: #1144621 Cross-References: CVE-2019-10216 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ghostscript fixes the following issues: Security issue fixed: - CVE-2019-10216: Fix privilege escalation via specially crafted PostScript file (bsc#1144621). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2139=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): ghostscript-9.26a-lp151.3.3.1 ghostscript-debuginfo-9.26a-lp151.3.3.1 ghostscript-debugsource-9.26a-lp151.3.3.1 ghostscript-devel-9.26a-lp151.3.3.1 ghostscript-mini-9.26a-lp151.3.3.1 ghostscript-mini-debuginfo-9.26a-lp151.3.3.1 ghostscript-mini-debugsource-9.26a-lp151.3.3.1 ghostscript-mini-devel-9.26a-lp151.3.3.1 ghostscript-x11-9.26a-lp151.3.3.1 ghostscript-x11-debuginfo-9.26a-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-10216.html https://bugzilla.suse.com/1144621 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2138-1: important: Security update for skopeo
by opensuse-security＠opensuse.org 15 Sep '19

15 Sep '19

openSUSE Security Update: Security update for skopeo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2138-1 Rating: important References: #1144065 Cross-References: CVE-2019-10214 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for skopeo fixes the following issues: Security issues fixed: - CVE-2019-10214: Fixed missing enforcement of TLS connections (bsc#1144065). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2138=1 Package List: - openSUSE Leap 15.1 (x86_64): skopeo-0.1.32-lp151.2.3.1 skopeo-debuginfo-0.1.32-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-10214.html https://bugzilla.suse.com/1144065 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2137-1: important: Security update for buildah
by opensuse-security＠opensuse.org 15 Sep '19

15 Sep '19

openSUSE Security Update: Security update for buildah ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2137-1 Rating: important References: #1144065 Cross-References: CVE-2019-10214 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for buildah fixes the following issues: Security issue fixed: - CVE-2019-10214: Fixed missing enforcement of TLS connections. (bsc#1144065) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2137=1 Package List: - openSUSE Leap 15.1 (x86_64): buildah-1.7.1-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-10214.html https://bugzilla.suse.com/1144065 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2133-1: moderate: Security update for python-urllib3
by opensuse-security＠opensuse.org 14 Sep '19

14 Sep '19

openSUSE Security Update: Security update for python-urllib3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2133-1 Rating: moderate References: #1129071 #1132663 #1132900 Cross-References: CVE-2019-11236 CVE-2019-11324 CVE-2019-9740 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for python-urllib3 fixes the following issues: Security issues fixed: - CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071). - CVE-2019-11324: Fixed invalid CA certificat verification (bsc#1132900). - CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2133=1 Package List: - openSUSE Leap 15.1 (noarch): python2-urllib3-1.24-lp151.2.3.1 python2-urllib3-test-1.24-lp151.2.3.1 python3-urllib3-1.24-lp151.2.3.1 python3-urllib3-test-1.24-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-11236.html https://www.suse.com/security/cve/CVE-2019-11324.html https://www.suse.com/security/cve/CVE-2019-9740.html https://bugzilla.suse.com/1129071 https://bugzilla.suse.com/1132663 https://bugzilla.suse.com/1132900 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2135-1: important: Security update for rdesktop
by opensuse-security＠opensuse.org 14 Sep '19

14 Sep '19

openSUSE Security Update: Security update for rdesktop ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2135-1 Rating: important References: #1121448 Cross-References: CVE-2018-20174 CVE-2018-20175 CVE-2018-20176 CVE-2018-20177 CVE-2018-20178 CVE-2018-20179 CVE-2018-20180 CVE-2018-20181 CVE-2018-20182 CVE-2018-8791 CVE-2018-8792 CVE-2018-8793 CVE-2018-8794 CVE-2018-8795 CVE-2018-8796 CVE-2018-8797 CVE-2018-8798 CVE-2018-8799 CVE-2018-8800 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 19 vulnerabilities is now available. Description: This update for rdesktop fixes the following issues: rdesktop was updated to 1.8.6: * Fix protocol code handling new licenses rdesktop was updated to 1.8.5: * Add bounds checking to protocol handling in order to fix many security problems when communicating with a malicious server. rdesktop was updated to 1.8.4 (fix for boo#1121448): * Add rdp_protocol_error function that is used in several fixes * Refactor of process_bitmap_updates * Fix possible integer overflow in s_check_rem() on 32bit arch * Fix memory corruption in process_bitmap_data - CVE-2018-8794 * Fix remote code execution in process_bitmap_data - CVE-2018-8795 * Fix remote code execution in process_plane - CVE-2018-8797 * Fix Denial of Service in mcs_recv_connect_response - CVE-2018-20175 * Fix Denial of Service in mcs_parse_domain_params - CVE-2018-20175 * Fix Denial of Service in sec_parse_crypt_info - CVE-2018-20176 * Fix Denial of Service in sec_recv - CVE-2018-20176 * Fix minor information leak in rdpdr_process - CVE-2018-8791 * Fix Denial of Service in cssp_read_tsrequest - CVE-2018-8792 * Fix remote code execution in cssp_read_tsrequest - CVE-2018-8793 * Fix Denial of Service in process_bitmap_data - CVE-2018-8796 * Fix minor information leak in rdpsnd_process_ping - CVE-2018-8798 * Fix Denial of Service in process_secondary_order - CVE-2018-8799 * Fix remote code execution in in ui_clip_handle_data - CVE-2018-8800 * Fix major information leak in ui_clip_handle_data - CVE-2018-20174 * Fix memory corruption in rdp_in_unistr - CVE-2018-20177 * Fix Denial of Service in process_demand_active - CVE-2018-20178 * Fix remote code execution in lspci_process - CVE-2018-20179 * Fix remote code execution in rdpsnddbg_process - CVE-2018-20180 * Fix remote code execution in seamless_process - CVE-2018-20181 * Fix remote code execution in seamless_process_line - CVE-2018-20182 * Fix building against OpenSSL 1.1 - remove obsolete patches * rdesktop-Fix-OpenSSL-1.1-compability-issues.patch * rdesktop-Fix-crash-in-rdssl_cert_to_rkey.patch - update changes file * add missing info about bugzilla 1121448 - Added rdesktop-Fix-decryption.patch Patch from https://github.com/rdesktop/rdesktop/pull/334 to fix connections to VirtualBox. - update to 1.8.6 * Fix protocol code handling new licenses - update to 1.8.5 * Add bounds checking to protocol handling in order to fix many security problems when communicating with a malicious server. - Trim redundant wording from description. - Use %make_install. - update to 1.8.4 (fix for boo#1121448) * Add rdp_protocol_error function that is used in several fixes * Refactor of process_bitmap_updates * Fix possible integer overflow in s_check_rem() on 32bit arch * Fix memory corruption in process_bitmap_data - CVE-2018-8794 * Fix remote code execution in process_bitmap_data - CVE-2018-8795 * Fix remote code execution in process_plane - CVE-2018-8797 * Fix Denial of Service in mcs_recv_connect_response - CVE-2018-20175 * Fix Denial of Service in mcs_parse_domain_params - CVE-2018-20175 * Fix Denial of Service in sec_parse_crypt_info - CVE-2018-20176 * Fix Denial of Service in sec_recv - CVE-2018-20176 * Fix minor information leak in rdpdr_process - CVE-2018-8791 * Fix Denial of Service in cssp_read_tsrequest - CVE-2018-8792 * Fix remote code execution in cssp_read_tsrequest - CVE-2018-8793 * Fix Denial of Service in process_bitmap_data - CVE-2018-8796 * Fix minor information leak in rdpsnd_process_ping - CVE-2018-8798 * Fix Denial of Service in process_secondary_order - CVE-2018-8799 * Fix remote code execution in in ui_clip_handle_data - CVE-2018-8800 * Fix major information leak in ui_clip_handle_data - CVE-2018-20174 * Fix memory corruption in rdp_in_unistr - CVE-2018-20177 * Fix Denial of Service in process_demand_active - CVE-2018-20178 * Fix remote code execution in lspci_process - CVE-2018-20179 * Fix remote code execution in rdpsnddbg_process - CVE-2018-20180 * Fix remote code execution in seamless_process - CVE-2018-20181 * Fix remote code execution in seamless_process_line - CVE-2018-20182 * Fix building against OpenSSL 1.1 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2135=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2135=1 Package List: - openSUSE Leap 15.1 (x86_64): rdesktop-1.8.6-lp151.2.3.1 rdesktop-debuginfo-1.8.6-lp151.2.3.1 rdesktop-debugsource-1.8.6-lp151.2.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): rdesktop-1.8.6-bp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-20174.html https://www.suse.com/security/cve/CVE-2018-20175.html https://www.suse.com/security/cve/CVE-2018-20176.html https://www.suse.com/security/cve/CVE-2018-20177.html https://www.suse.com/security/cve/CVE-2018-20178.html https://www.suse.com/security/cve/CVE-2018-20179.html https://www.suse.com/security/cve/CVE-2018-20180.html https://www.suse.com/security/cve/CVE-2018-20181.html https://www.suse.com/security/cve/CVE-2018-20182.html https://www.suse.com/security/cve/CVE-2018-8791.html https://www.suse.com/security/cve/CVE-2018-8792.html https://www.suse.com/security/cve/CVE-2018-8793.html https://www.suse.com/security/cve/CVE-2018-8794.html https://www.suse.com/security/cve/CVE-2018-8795.html https://www.suse.com/security/cve/CVE-2018-8796.html https://www.suse.com/security/cve/CVE-2018-8797.html https://www.suse.com/security/cve/CVE-2018-8798.html https://www.suse.com/security/cve/CVE-2018-8799.html https://www.suse.com/security/cve/CVE-2018-8800.html https://bugzilla.suse.com/1121448 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2131-1: moderate: Security update for python-urllib3
by opensuse-security＠opensuse.org 14 Sep '19

14 Sep '19

openSUSE Security Update: Security update for python-urllib3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2131-1 Rating: moderate References: #1119376 #1129071 #1132663 #1132900 Cross-References: CVE-2018-20060 CVE-2019-11236 CVE-2019-11324 CVE-2019-9740 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for python-urllib3 fixes the following issues: Security issues fixed: - CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071). - CVE-2019-11324: Fixed invalid CA certificat verification (bsc#1132900). - CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663). - CVE-2018-20060: Remove Authorization header when redirecting cross-host (bsc#1119376). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2131=1 Package List: - openSUSE Leap 15.0 (noarch): python2-urllib3-1.22-lp150.5.3.1 python3-urllib3-1.22-lp150.5.3.1 References: https://www.suse.com/security/cve/CVE-2018-20060.html https://www.suse.com/security/cve/CVE-2019-11236.html https://www.suse.com/security/cve/CVE-2019-11324.html https://www.suse.com/security/cve/CVE-2019-9740.html https://bugzilla.suse.com/1119376 https://bugzilla.suse.com/1129071 https://bugzilla.suse.com/1132663 https://bugzilla.suse.com/1132900 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2130-1: moderate: Security update for go1.12
by opensuse-security＠opensuse.org 14 Sep '19

14 Sep '19

openSUSE Security Update: Security update for go1.12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2130-1 Rating: moderate References: #1139210 #1141689 #1146111 #1146115 #1146123 Cross-References: CVE-2019-14809 CVE-2019-9512 CVE-2019-9514 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for go1.12 fixes the following issues: Security issues fixed: - CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115). - CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123). Bugfixes: - Update to go version 1.12.9 (bsc#1141689). - Adding Web Assembly stuff from misc/wasm (bsc#1139210). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2130=1 Package List: - openSUSE Leap 15.1 (x86_64): go1.12-1.12.9-lp151.2.21.1 go1.12-doc-1.12.9-lp151.2.21.1 go1.12-race-1.12.9-lp151.2.21.1 References: https://www.suse.com/security/cve/CVE-2019-14809.html https://www.suse.com/security/cve/CVE-2019-9512.html https://www.suse.com/security/cve/CVE-2019-9514.html https://bugzilla.suse.com/1139210 https://bugzilla.suse.com/1141689 https://bugzilla.suse.com/1146111 https://bugzilla.suse.com/1146115 https://bugzilla.suse.com/1146123 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2129-1: moderate: Security update for libmirage
by opensuse-security＠opensuse.org 14 Sep '19

14 Sep '19

openSUSE Security Update: Security update for libmirage ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2129-1 Rating: moderate References: #1148728 Cross-References: CVE-2019-15757 Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libmirage fixes the following issues: Security issues fixed: - CVE-2019-15757: Fixed NULL pointer dereference in the NRG parser (boo#1148728). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2129=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2129=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libmirage-3_2-3.2.2-bp151.4.6.1 libmirage-3_2-debuginfo-3.2.2-bp151.4.6.1 libmirage-debuginfo-3.2.2-bp151.4.6.1 libmirage-debugsource-3.2.2-bp151.4.6.1 libmirage-devel-3.2.2-bp151.4.6.1 libmirage11-3.2.2-bp151.4.6.1 libmirage11-debuginfo-3.2.2-bp151.4.6.1 typelib-1_0-libmirage-3_2-3.2.2-bp151.4.6.1 - openSUSE Backports SLE-15-SP1 (noarch): libmirage-data-3.2.2-bp151.4.6.1 libmirage-lang-3.2.2-bp151.4.6.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libmirage-3_2-3.2.2-bp150.3.6.1 libmirage-devel-3.2.2-bp150.3.6.1 libmirage11-3.2.2-bp150.3.6.1 typelib-1_0-libmirage-3_2-3.2.2-bp150.3.6.1 - openSUSE Backports SLE-15 (noarch): libmirage-data-3.2.2-bp150.3.6.1 libmirage-lang-3.2.2-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-15757.html https://bugzilla.suse.com/1148728 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2128-1: moderate: Security update for srt
by opensuse-security＠opensuse.org 13 Sep '19

13 Sep '19

openSUSE Security Update: Security update for srt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2128-1 Rating: moderate References: #1148844 Cross-References: CVE-2019-15784 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: srt was updated to version 1.3.4. Security issues fixed: * CVE-2019-15784: avoid a potential array overflow. (boo#1148844) * New binary: srt-tunnel * srt-multiplexer binary is now a testing application and thus is dropped from our package. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2128=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libsrt1-1.3.4-bp151.3.3.1 srt-1.3.4-bp151.3.3.1 srt-devel-1.3.4-bp151.3.3.1 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libsrt1-64bit-1.3.4-bp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-15784.html https://bugzilla.suse.com/1148844 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2120-1: important: Security update for nginx
by opensuse-security＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Security Update: Security update for nginx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2120-1 Rating: important References: #1115015 #1115022 #1115025 #1145579 #1145580 #1145582 Cross-References: CVE-2018-16843 CVE-2018-16844 CVE-2018-16845 CVE-2019-9511 CVE-2019-9513 CVE-2019-9516 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for nginx fixes the following issues: Security issues fixed: - CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579). - CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580). - CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582). - CVE-2018-16845: Fixed denial of service and memory disclosure via mp4 module (bsc#1115015). - CVE-2018-16843: Fixed excessive memory consumption in HTTP/2 implementation (bsc#1115022). - CVE-2018-16844: Fixed excessive CPU usage via flaw in HTTP/2 implementation (bsc#1115025). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2120=1 Package List: - openSUSE Leap 15.1 (x86_64): nginx-1.14.2-lp151.4.3.1 nginx-debuginfo-1.14.2-lp151.4.3.1 nginx-debugsource-1.14.2-lp151.4.3.1 - openSUSE Leap 15.1 (noarch): nginx-source-1.14.2-lp151.4.3.1 vim-plugin-nginx-1.14.2-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-16843.html https://www.suse.com/security/cve/CVE-2018-16844.html https://www.suse.com/security/cve/CVE-2018-16845.html https://www.suse.com/security/cve/CVE-2019-9511.html https://www.suse.com/security/cve/CVE-2019-9513.html https://www.suse.com/security/cve/CVE-2019-9516.html https://bugzilla.suse.com/1115015 https://bugzilla.suse.com/1115022 https://bugzilla.suse.com/1115025 https://bugzilla.suse.com/1145579 https://bugzilla.suse.com/1145580 https://bugzilla.suse.com/1145582 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2118-1: moderate: Security update for python-Werkzeug
by opensuse-security＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Security Update: Security update for python-Werkzeug ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2118-1 Rating: moderate References: #1145383 Cross-References: CVE-2019-14806 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Werkzeug fixes the following issues: Security issue fixed: - CVE-2019-14806: Fixed the development server in Docker, the debugger security pin is now unique per container (bsc#1145383). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2118=1 Package List: - openSUSE Leap 15.0 (noarch): python-Werkzeug-doc-0.12.2-lp150.2.3.1 python2-Werkzeug-0.12.2-lp150.2.3.1 python3-Werkzeug-0.12.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-14806.html https://bugzilla.suse.com/1145383 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2121-1: moderate: Security update for util-linux and shadow
by opensuse-security＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Security Update: Security update for util-linux and shadow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2121-1 Rating: moderate References: #1081947 #1082293 #1085196 #1106214 #1121197 #1122417 #1125886 #1127701 #1135534 #1135708 #1141113 #353876 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for util-linux and shadow fixes the following issues: util-linux: - Fixed an issue where PATH settings in /etc/default/su being ignored (bsc#1121197) - Prevent outdated pam files (bsc#1082293). - De-duplicate fstrim -A properly (bsc#1127701). - Do not trim read-only volumes (bsc#1106214). - Integrate pam_keyinit pam module to login (bsc#1081947). - Perform one-time reset of /etc/default/su (bsc#1121197). - Fix problems in reading of login.defs values (bsc#1121197) - libmount: To prevent incorrect behavior, recognize more pseudofs and netfs (bsc#1122417). - raw.service: Add RemainAfterExit=yes (bsc#1135534). - agetty: Return previous response of agetty for special characters (bsc#1085196, bsc#1125886) - libmount: print a blacklist hint for "unknown filesystem type" (jsc#SUSE-4085, fate#326832) - Fix /etc/default/su comments and create /etc/default/runuser (bsc#1121197). shadow: - Fixed an issue where PATH settings in /etc/default/su being ignored (bsc#1121197) - Fix segfault in useradd during setting password inactivity period. (bsc#1141113) - Hardening for su wrappers (bsc#353876) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2121=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libblkid-devel-2.33.1-lp151.3.3.2 libblkid-devel-static-2.33.1-lp151.3.3.2 libblkid1-2.33.1-lp151.3.3.2 libblkid1-debuginfo-2.33.1-lp151.3.3.2 libfdisk-devel-2.33.1-lp151.3.3.2 libfdisk-devel-static-2.33.1-lp151.3.3.2 libfdisk1-2.33.1-lp151.3.3.2 libfdisk1-debuginfo-2.33.1-lp151.3.3.2 libmount-devel-2.33.1-lp151.3.3.2 libmount-devel-static-2.33.1-lp151.3.3.2 libmount1-2.33.1-lp151.3.3.2 libmount1-debuginfo-2.33.1-lp151.3.3.2 libsmartcols-devel-2.33.1-lp151.3.3.2 libsmartcols-devel-static-2.33.1-lp151.3.3.2 libsmartcols1-2.33.1-lp151.3.3.2 libsmartcols1-debuginfo-2.33.1-lp151.3.3.2 libuuid-devel-2.33.1-lp151.3.3.2 libuuid-devel-static-2.33.1-lp151.3.3.2 libuuid1-2.33.1-lp151.3.3.2 libuuid1-debuginfo-2.33.1-lp151.3.3.2 shadow-4.6-lp151.2.3.2 shadow-debuginfo-4.6-lp151.2.3.2 shadow-debugsource-4.6-lp151.2.3.2 util-linux-2.33.1-lp151.3.3.2 util-linux-debuginfo-2.33.1-lp151.3.3.2 util-linux-debugsource-2.33.1-lp151.3.3.2 util-linux-systemd-2.33.1-lp151.3.3.2 util-linux-systemd-debuginfo-2.33.1-lp151.3.3.2 util-linux-systemd-debugsource-2.33.1-lp151.3.3.2 uuidd-2.33.1-lp151.3.3.2 uuidd-debuginfo-2.33.1-lp151.3.3.2 - openSUSE Leap 15.1 (noarch): util-linux-lang-2.33.1-lp151.3.3.2 - openSUSE Leap 15.1 (x86_64): libblkid-devel-32bit-2.33.1-lp151.3.3.2 libblkid1-32bit-2.33.1-lp151.3.3.2 libblkid1-32bit-debuginfo-2.33.1-lp151.3.3.2 libmount-devel-32bit-2.33.1-lp151.3.3.2 libmount1-32bit-2.33.1-lp151.3.3.2 libmount1-32bit-debuginfo-2.33.1-lp151.3.3.2 libuuid-devel-32bit-2.33.1-lp151.3.3.2 libuuid1-32bit-2.33.1-lp151.3.3.2 libuuid1-32bit-debuginfo-2.33.1-lp151.3.3.2 python3-libmount-2.33.1-lp151.3.3.2 python3-libmount-debuginfo-2.33.1-lp151.3.3.2 python3-libmount-debugsource-2.33.1-lp151.3.3.2 References: https://bugzilla.suse.com/1081947 https://bugzilla.suse.com/1082293 https://bugzilla.suse.com/1085196 https://bugzilla.suse.com/1106214 https://bugzilla.suse.com/1121197 https://bugzilla.suse.com/1122417 https://bugzilla.suse.com/1125886 https://bugzilla.suse.com/1127701 https://bugzilla.suse.com/1135534 https://bugzilla.suse.com/1135708 https://bugzilla.suse.com/1141113 https://bugzilla.suse.com/353876 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2114-1: important: Security update for nodejs10
by opensuse-security＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Security Update: Security update for nodejs10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2114-1 Rating: important References: #1146090 #1146091 #1146093 #1146094 #1146095 #1146097 #1146099 #1146100 Cross-References: CVE-2019-9511 CVE-2019-9512 CVE-2019-9513 CVE-2019-9514 CVE-2019-9515 CVE-2019-9516 CVE-2019-9517 CVE-2019-9518 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for nodejs10 to version 10.16.3 fixes the following issues: Security issues fixed: - CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091). - CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099). - CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095). - CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100). - CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090). - CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097). - CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2114=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2114=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): nodejs10-10.16.3-lp151.2.6.1 nodejs10-debuginfo-10.16.3-lp151.2.6.1 nodejs10-debugsource-10.16.3-lp151.2.6.1 nodejs10-devel-10.16.3-lp151.2.6.1 npm10-10.16.3-lp151.2.6.1 - openSUSE Leap 15.1 (noarch): nodejs10-docs-10.16.3-lp151.2.6.1 - openSUSE Leap 15.0 (x86_64): nodejs10-10.16.3-lp150.5.1 nodejs10-debuginfo-10.16.3-lp150.5.1 nodejs10-debugsource-10.16.3-lp150.5.1 nodejs10-devel-10.16.3-lp150.5.1 npm10-10.16.3-lp150.5.1 - openSUSE Leap 15.0 (noarch): nodejs10-docs-10.16.3-lp150.5.1 References: https://www.suse.com/security/cve/CVE-2019-9511.html https://www.suse.com/security/cve/CVE-2019-9512.html https://www.suse.com/security/cve/CVE-2019-9513.html https://www.suse.com/security/cve/CVE-2019-9514.html https://www.suse.com/security/cve/CVE-2019-9515.html https://www.suse.com/security/cve/CVE-2019-9516.html https://www.suse.com/security/cve/CVE-2019-9517.html https://www.suse.com/security/cve/CVE-2019-9518.html https://bugzilla.suse.com/1146090 https://bugzilla.suse.com/1146091 https://bugzilla.suse.com/1146093 https://bugzilla.suse.com/1146094 https://bugzilla.suse.com/1146095 https://bugzilla.suse.com/1146097 https://bugzilla.suse.com/1146099 https://bugzilla.suse.com/1146100 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2115-1: important: Security update for nodejs8
by opensuse-security＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Security Update: Security update for nodejs8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2115-1 Rating: important References: #1144919 #1146090 #1146091 #1146093 #1146094 #1146095 #1146097 #1146099 #1146100 Cross-References: CVE-2019-9511 CVE-2019-9512 CVE-2019-9513 CVE-2019-9514 CVE-2019-9515 CVE-2019-9516 CVE-2019-9517 CVE-2019-9518 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has one errata is now available. Description: This update for nodejs8 to version 8.16.1 fixes the following issues: Security issues fixed: - CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091). - CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099). - CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095). - CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100). - CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090). - CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097). - CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093). Bug fixes: - Fixed that npm resolves its default config file like in all other versions, as /etc/nodejs/npmrc (bsc#1144919). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2115=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2115=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): nodejs8-8.16.1-lp151.2.6.1 nodejs8-debuginfo-8.16.1-lp151.2.6.1 nodejs8-debugsource-8.16.1-lp151.2.6.1 nodejs8-devel-8.16.1-lp151.2.6.1 npm8-8.16.1-lp151.2.6.1 - openSUSE Leap 15.1 (noarch): nodejs8-docs-8.16.1-lp151.2.6.1 - openSUSE Leap 15.0 (i586 x86_64): nodejs8-8.16.1-lp150.2.19.1 nodejs8-debuginfo-8.16.1-lp150.2.19.1 nodejs8-debugsource-8.16.1-lp150.2.19.1 nodejs8-devel-8.16.1-lp150.2.19.1 npm8-8.16.1-lp150.2.19.1 - openSUSE Leap 15.0 (noarch): nodejs8-docs-8.16.1-lp150.2.19.1 References: https://www.suse.com/security/cve/CVE-2019-9511.html https://www.suse.com/security/cve/CVE-2019-9512.html https://www.suse.com/security/cve/CVE-2019-9513.html https://www.suse.com/security/cve/CVE-2019-9514.html https://www.suse.com/security/cve/CVE-2019-9515.html https://www.suse.com/security/cve/CVE-2019-9516.html https://www.suse.com/security/cve/CVE-2019-9517.html https://www.suse.com/security/cve/CVE-2019-9518.html https://bugzilla.suse.com/1144919 https://bugzilla.suse.com/1146090 https://bugzilla.suse.com/1146091 https://bugzilla.suse.com/1146093 https://bugzilla.suse.com/1146094 https://bugzilla.suse.com/1146095 https://bugzilla.suse.com/1146097 https://bugzilla.suse.com/1146099 https://bugzilla.suse.com/1146100 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2109-1: moderate: Security update for SDL_image
by opensuse-security＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Security Update: Security update for SDL_image ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2109-1 Rating: moderate References: #1124827 #1140421 #1141844 #1143763 #1143764 #1143766 #1143768 Cross-References: CVE-2019-13616 CVE-2019-5052 CVE-2019-5057 CVE-2019-5058 CVE-2019-5059 CVE-2019-5060 CVE-2019-7635 Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for SDL_image fixes the following issues: Update SDL_Image to new snapshot 1.2.12+hg695. Security issues fixed: * TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421) * TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763) * TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764) * TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image handling (boo#1143766) * TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768) * CVE-2019-7635: heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c (boo#1124827) * CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2109=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2109=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): SDL_image-debugsource-1.2.12+hg695-bp151.4.3.1 libSDL_image-1_2-0-1.2.12+hg695-bp151.4.3.1 libSDL_image-1_2-0-debuginfo-1.2.12+hg695-bp151.4.3.1 libSDL_image-devel-1.2.12+hg695-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libSDL_image-1_2-0-64bit-1.2.12+hg695-bp151.4.3.1 libSDL_image-1_2-0-64bit-debuginfo-1.2.12+hg695-bp151.4.3.1 libSDL_image-devel-64bit-1.2.12+hg695-bp151.4.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libSDL_image-1_2-0-1.2.12+hg695-bp150.3.3.1 libSDL_image-devel-1.2.12+hg695-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libSDL_image-1_2-0-64bit-1.2.12+hg695-bp150.3.3.1 libSDL_image-devel-64bit-1.2.12+hg695-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-13616.html https://www.suse.com/security/cve/CVE-2019-5052.html https://www.suse.com/security/cve/CVE-2019-5057.html https://www.suse.com/security/cve/CVE-2019-5058.html https://www.suse.com/security/cve/CVE-2019-5059.html https://www.suse.com/security/cve/CVE-2019-5060.html https://www.suse.com/security/cve/CVE-2019-7635.html https://bugzilla.suse.com/1124827 https://bugzilla.suse.com/1140421 https://bugzilla.suse.com/1141844 https://bugzilla.suse.com/1143763 https://bugzilla.suse.com/1143764 https://bugzilla.suse.com/1143766 https://bugzilla.suse.com/1143768 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2108-1: moderate: Security update for SDL2_image
by opensuse-security＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Security Update: Security update for SDL2_image ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2108-1 Rating: moderate References: #1135787 #1135789 #1135796 #1135806 #1136101 #1140419 #1140421 #1141844 #1143763 #1143764 #1143766 #1143768 Cross-References: CVE-2019-12217 CVE-2019-12218 CVE-2019-12220 CVE-2019-12221 CVE-2019-12222 CVE-2019-13616 CVE-2019-5051 CVE-2019-5052 CVE-2019-5057 CVE-2019-5058 CVE-2019-5059 CVE-2019-5060 Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for SDL2_image fixes the following issues: Update to new upstream release 2.0.5. Security issues fixed: * TALOS-2019-0820 CVE-2019-5051: exploitable heap-based buffer overflow vulnerability when loading a PCX file (boo#1140419) * TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421) * TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763) * TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764) * TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image (boo#1143766) * TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768) Not mentioned by upstream, but issues seemingly further fixed: * CVE-2019-12218: NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW (boo#1135789) * CVE-2019-12217: NULL pointer dereference in the SDL stdio_read function (boo#1135787) * CVE-2019-12220: SDL_image triggers an out-of-bounds read in the SDL function SDL_FreePalette_REAL (boo#1135806) * CVE-2019-12221: a SEGV caused by SDL_image in SDL function SDL_free_REAL in stdlib/SDL_malloc.c (boo#1135796) * CVE-2019-12222: out-of-bounds read triggered by SDL_image in the function SDL_InvalidateMap at video/SDL_pixels.c (boo#1136101) * CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2108=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2108=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): SDL2_image-debugsource-2.0.5-bp151.4.3.1 libSDL2_image-2_0-0-2.0.5-bp151.4.3.1 libSDL2_image-2_0-0-debuginfo-2.0.5-bp151.4.3.1 libSDL2_image-devel-2.0.5-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1 libSDL2_image-2_0-0-64bit-debuginfo-2.0.5-bp151.4.3.1 libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libSDL2_image-2_0-0-2.0.5-bp150.3.6.1 libSDL2_image-devel-2.0.5-bp150.3.6.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libSDL2_image-2_0-0-64bit-2.0.5-bp150.3.6.1 libSDL2_image-devel-64bit-2.0.5-bp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-12217.html https://www.suse.com/security/cve/CVE-2019-12218.html https://www.suse.com/security/cve/CVE-2019-12220.html https://www.suse.com/security/cve/CVE-2019-12221.html https://www.suse.com/security/cve/CVE-2019-12222.html https://www.suse.com/security/cve/CVE-2019-13616.html https://www.suse.com/security/cve/CVE-2019-5051.html https://www.suse.com/security/cve/CVE-2019-5052.html https://www.suse.com/security/cve/CVE-2019-5057.html https://www.suse.com/security/cve/CVE-2019-5058.html https://www.suse.com/security/cve/CVE-2019-5059.html https://www.suse.com/security/cve/CVE-2019-5060.html https://bugzilla.suse.com/1135787 https://bugzilla.suse.com/1135789 https://bugzilla.suse.com/1135796 https://bugzilla.suse.com/1135806 https://bugzilla.suse.com/1136101 https://bugzilla.suse.com/1140419 https://bugzilla.suse.com/1140421 https://bugzilla.suse.com/1141844 https://bugzilla.suse.com/1143763 https://bugzilla.suse.com/1143764 https://bugzilla.suse.com/1143766 https://bugzilla.suse.com/1143768 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2110-1: moderate: Security update for python-Twisted
by opensuse-security＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Security Update: Security update for python-Twisted ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2110-1 Rating: moderate References: #1138461 Cross-References: CVE-2019-12855 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Twisted fixes the following issues: Security issue fixed: - CVE-2019-12855: Fixed TLS certificate verification to protecting against MITM attacks (bsc#1138461). This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2110=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): python-Twisted-doc-17.9.0-bp150.4.6.1 python2-Twisted-17.9.0-bp150.4.6.1 python3-Twisted-17.9.0-bp150.4.6.1 References: https://www.suse.com/security/cve/CVE-2019-12855.html https://bugzilla.suse.com/1138461 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2107-1: important: Recommended update for opera
by opensuse-security＠opensuse.org 10 Sep '19

10 Sep '19

openSUSE Security Update: Recommended update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2107-1 Rating: important References: Affected Products: openSUSE Leap 15.1:NonFree openSUSE Leap 15.0:NonFree ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for opera fixes the following issues: Opera was updated to version 63.0.3368.66: - CHR-7525 Update chromium on desktop-stable-76-3368 to 76.0.3809.132 - DNA-74031 Download indicator doesn’t match progress - DNA-77042 Something went wrong message in crypto wallet in private window - DNA-79137 Crash at opera::installer::OptionsScreen:: OnLanguageChanged() - DNA-79683 Installer crashes when showing progress - DNA-79757 Line divider under address bar disappears after opening and closing Bookmarks Bar - DNA-80012 Zoom popup appears each time clicking ‘heart’ icon - DNA-80110 Bug when changing the install path in installer - DNA-80417 [assistant] Crash at opera::avro::event_driven::StatSenderImpl::NetworkThread:: SetTrafficAllowed(bool) - DNA-80422 Continue shopping section is too close to Speed Dial tiles when tiles are big - DNA-80463 Add shadow to shopping tiles - DNA-78143 Load async resources before rendering the page - DNA-79102 Make AU to be always server IPC endpoint when new AU logic is enabled - DNA-80193 Magnifying glass icon doesn’t match the search box boundaries in settings and extensions - DNA-80416 Crash at opera::assistant::ProcessMonitorImpl:: ObserveProcess(std::__1::basic_string const&, opera::assistant:: ProcessMonitor::Observer*) - DNA-79558 Add database for continue shopping feature - DNA-79560 Create hidden runtime flag #continue-shopping - DNA-79702 Create Continue Shopping service - DNA-79786 Fix database backend for deleting the partner offer - DNA-80193 Magnifying glass icon doesn’t match the search box boundaries in settings and extensions - DNA-80237 Prevent data collection when feature is off - DNA-80244 Introduce another feature flag for changing the default value of folded state - DNA-79558 Add database for continue shopping feature - DNA-79560 Create hidden runtime flag #continue-shopping - DNA-79702 Create Continue Shopping service - DNA-79786 Fix database backend for deleting the partner offer - DNA-80193 Magnifying glass icon doesn’t match the search box boundaries in settings and extensions - DNA-80237 Prevent data collection when feature is off - DNA-80244 Introduce another feature flag for changing the default value of folded state - DNA-79560 Create hidden runtime flag #continue-shopping - DNA-79702 Create Continue Shopping service - DNA-79786 Fix database backend for deleting the partner offer - DNA-80193 Magnifying glass icon doesn’t match the search box boundaries in settings and extensions - DNA-80237 Prevent data collection when feature is off - DNA-80244 Introduce another feature flag for changing the default value of folded state - DNA-79063 Address bar icons are hardly visible in private window in light mode - DNA-79274 No warning notification on quitting Opera with multiple tabs open after update - DNA-80103 Investigate best ICECC_THREADS for faster Mac builds - DNA-80105 O63 translations (08.08.2019) - DNA-80219 DCHECK at ExtensionDownloader::HandleManifestResults - DNA-80330 [My Flow] The QR code and connection code is not visible for some people - DNA-79569 Don’t provide default value for titleTextColor in opr.wallpapersAPI - DNA-80221 Change channel to “stable” in permissions features for wallpapersPrivate - DNA-80230 Promote O63 to stable Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1:NonFree: zypper in -t patch openSUSE-2019-2107=1 - openSUSE Leap 15.0:NonFree: zypper in -t patch openSUSE-2019-2107=1 Package List: - openSUSE Leap 15.1:NonFree (x86_64): opera-63.0.3368.66-lp151.2.6.1 - openSUSE Leap 15.0:NonFree (x86_64): opera-63.0.3368.66-lp150.2.18.1 References: -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2096-1: moderate: Security update for libmirage
by opensuse-security＠opensuse.org 08 Sep '19

08 Sep '19

openSUSE Security Update: Security update for libmirage ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2096-1 Rating: moderate References: #1148728 Cross-References: CVE-2019-15757 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libmirage fixes the following issues: Security issues fixed: - CVE-2019-15757: Fixed NULL pointer dereference in the NRG parser (boo#1148728). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2096=1 Package List: - openSUSE Leap 15.1 (x86_64): libmirage-3_2-3.2.2-lp151.3.6.1 libmirage-3_2-debuginfo-3.2.2-lp151.3.6.1 libmirage-debuginfo-3.2.2-lp151.3.6.1 libmirage-debugsource-3.2.2-lp151.3.6.1 libmirage-devel-3.2.2-lp151.3.6.1 libmirage11-3.2.2-lp151.3.6.1 libmirage11-debuginfo-3.2.2-lp151.3.6.1 typelib-1_0-libmirage-3_2-3.2.2-lp151.3.6.1 - openSUSE Leap 15.1 (noarch): libmirage-data-3.2.2-lp151.3.6.1 libmirage-lang-3.2.2-lp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-15757.html https://bugzilla.suse.com/1148728 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2095-1: moderate: Security update for libmirage
by opensuse-security＠opensuse.org 08 Sep '19

08 Sep '19

openSUSE Security Update: Security update for libmirage ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2095-1 Rating: moderate References: #1148728 Cross-References: CVE-2019-15757 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libmirage fixes the following issues: Security issues fixed: - CVE-2019-15757: Fixed NULL pointer dereference in the NRG parser (boo#1148728). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2095=1 Package List: - openSUSE Leap 15.0 (x86_64): libmirage-3_2-3.2.2-lp150.2.6.1 libmirage-3_2-debuginfo-3.2.2-lp150.2.6.1 libmirage-debuginfo-3.2.2-lp150.2.6.1 libmirage-debugsource-3.2.2-lp150.2.6.1 libmirage-devel-3.2.2-lp150.2.6.1 libmirage11-3.2.2-lp150.2.6.1 libmirage11-debuginfo-3.2.2-lp150.2.6.1 typelib-1_0-libmirage-3_2-3.2.2-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): libmirage-data-3.2.2-lp150.2.6.1 libmirage-lang-3.2.2-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-15757.html https://bugzilla.suse.com/1148728 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2093-1: important: Security update for exim
by opensuse-security＠opensuse.org 08 Sep '19

08 Sep '19

openSUSE Security Update: Security update for exim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2093-1 Rating: important References: #1149182 Cross-References: CVE-2019-15846 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: exim was updated to fix a security issue: - CVE-2019-15846: Fixed a buffer overflow in SMTP Delivery process where a remote attacker could execute code with root privileges by sending crafted SNI data (boo#1149182). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2093=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2093=1 Package List: - openSUSE Leap 15.1 (x86_64): exim-4.88-lp151.4.9.1 exim-debuginfo-4.88-lp151.4.9.1 exim-debugsource-4.88-lp151.4.9.1 eximon-4.88-lp151.4.9.1 eximon-debuginfo-4.88-lp151.4.9.1 eximstats-html-4.88-lp151.4.9.1 - openSUSE Leap 15.0 (x86_64): exim-4.88-lp150.3.9.1 exim-debuginfo-4.88-lp150.3.9.1 exim-debugsource-4.88-lp150.3.9.1 eximon-4.88-lp150.3.9.1 eximon-debuginfo-4.88-lp150.3.9.1 eximstats-html-4.88-lp150.3.9.1 References: https://www.suse.com/security/cve/CVE-2019-15846.html https://bugzilla.suse.com/1149182 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2094-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 08 Sep '19

08 Sep '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2094-1 Rating: moderate References: #1146219 #1149143 Cross-References: CVE-2019-5869 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for chromium fixes the following issues: Security issues fixed: - CVE-2019-5869: Fixed use-after-free in Blink (boo#1149143). - Various fixes from internal audits, fuzzing and other initiatives. Non-security issues fixed: - Fixed no video playback on Intel Kaby Lake and later (boo#1146219). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2094=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-76.0.3809.132-bp151.3.9.1 chromium-76.0.3809.132-bp151.3.9.1 References: https://www.suse.com/security/cve/CVE-2019-5869.html https://bugzilla.suse.com/1146219 https://bugzilla.suse.com/1149143 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2089-1: moderate: Security update for httpie
by opensuse-security＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Security Update: Security update for httpie ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2089-1 Rating: moderate References: #1148466 Cross-References: CVE-2019-10751 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for httpie fixes the following issues: httpie was updated to version 1.0.3: * Fix CVE-2019-10751 (HTTPie is vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control. (bsc#1148466) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2089=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): python3-httpie-1.0.3-bp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-10751.html https://bugzilla.suse.com/1148466 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2085-1: moderate: Security update for go1.12
by opensuse-security＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Security Update: Security update for go1.12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2085-1 Rating: moderate References: #1139210 #1141689 #1146111 #1146115 #1146123 Cross-References: CVE-2019-14809 CVE-2019-9512 CVE-2019-9514 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for go1.12 fixes the following issues: Security issues fixed: - CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115). - CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123). Bugfixes: - Update to go version 1.12.9 (bsc#1141689). - Adding Web Assembly stuff from misc/wasm (bsc#1139210). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2085=1 Package List: - openSUSE Leap 15.1 (x86_64): go1.12-1.12.9-lp151.2.17.1 go1.12-doc-1.12.9-lp151.2.17.1 go1.12-race-1.12.9-lp151.2.17.1 References: https://www.suse.com/security/cve/CVE-2019-14809.html https://www.suse.com/security/cve/CVE-2019-9512.html https://www.suse.com/security/cve/CVE-2019-9514.html https://bugzilla.suse.com/1139210 https://bugzilla.suse.com/1141689 https://bugzilla.suse.com/1146111 https://bugzilla.suse.com/1146115 https://bugzilla.suse.com/1146123 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2083-1: moderate: Security update for srt
by opensuse-security＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Security Update: Security update for srt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2083-1 Rating: moderate References: #1148844 Cross-References: CVE-2019-15784 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: srt was updated to version 1.3.4. Security issues fixed: * CVE-2019-15784: avoid a potential array overflow. (boo#1148844) * New binary: srt-tunnel * srt-multiplexer binary is now a testing application and thus is dropped from our package. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2083=1 Package List: - openSUSE Leap 15.1 (x86_64): libsrt1-1.3.4-lp151.2.3.1 libsrt1-debuginfo-1.3.4-lp151.2.3.1 srt-1.3.4-lp151.2.3.1 srt-debuginfo-1.3.4-lp151.2.3.1 srt-debugsource-1.3.4-lp151.2.3.1 srt-devel-1.3.4-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-15784.html https://bugzilla.suse.com/1148844 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0