September 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:2093-1: important: Security update for exim
by opensuse-security＠opensuse.org 08 Sep '19

08 Sep '19

openSUSE Security Update: Security update for exim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2093-1 Rating: important References: #1149182 Cross-References: CVE-2019-15846 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: exim was updated to fix a security issue: - CVE-2019-15846: Fixed a buffer overflow in SMTP Delivery process where a remote attacker could execute code with root privileges by sending crafted SNI data (boo#1149182). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2093=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2093=1 Package List: - openSUSE Leap 15.1 (x86_64): exim-4.88-lp151.4.9.1 exim-debuginfo-4.88-lp151.4.9.1 exim-debugsource-4.88-lp151.4.9.1 eximon-4.88-lp151.4.9.1 eximon-debuginfo-4.88-lp151.4.9.1 eximstats-html-4.88-lp151.4.9.1 - openSUSE Leap 15.0 (x86_64): exim-4.88-lp150.3.9.1 exim-debuginfo-4.88-lp150.3.9.1 exim-debugsource-4.88-lp150.3.9.1 eximon-4.88-lp150.3.9.1 eximon-debuginfo-4.88-lp150.3.9.1 eximstats-html-4.88-lp150.3.9.1 References: https://www.suse.com/security/cve/CVE-2019-15846.html https://bugzilla.suse.com/1149182 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2094-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 08 Sep '19

08 Sep '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2094-1 Rating: moderate References: #1146219 #1149143 Cross-References: CVE-2019-5869 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for chromium fixes the following issues: Security issues fixed: - CVE-2019-5869: Fixed use-after-free in Blink (boo#1149143). - Various fixes from internal audits, fuzzing and other initiatives. Non-security issues fixed: - Fixed no video playback on Intel Kaby Lake and later (boo#1146219). This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2094=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-76.0.3809.132-bp151.3.9.1 chromium-76.0.3809.132-bp151.3.9.1 References: https://www.suse.com/security/cve/CVE-2019-5869.html https://bugzilla.suse.com/1146219 https://bugzilla.suse.com/1149143 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2089-1: moderate: Security update for httpie
by opensuse-security＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Security Update: Security update for httpie ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2089-1 Rating: moderate References: #1148466 Cross-References: CVE-2019-10751 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for httpie fixes the following issues: httpie was updated to version 1.0.3: * Fix CVE-2019-10751 (HTTPie is vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control. (bsc#1148466) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2089=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): python3-httpie-1.0.3-bp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-10751.html https://bugzilla.suse.com/1148466 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2085-1: moderate: Security update for go1.12
by opensuse-security＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Security Update: Security update for go1.12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2085-1 Rating: moderate References: #1139210 #1141689 #1146111 #1146115 #1146123 Cross-References: CVE-2019-14809 CVE-2019-9512 CVE-2019-9514 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for go1.12 fixes the following issues: Security issues fixed: - CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115). - CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123). Bugfixes: - Update to go version 1.12.9 (bsc#1141689). - Adding Web Assembly stuff from misc/wasm (bsc#1139210). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2085=1 Package List: - openSUSE Leap 15.1 (x86_64): go1.12-1.12.9-lp151.2.17.1 go1.12-doc-1.12.9-lp151.2.17.1 go1.12-race-1.12.9-lp151.2.17.1 References: https://www.suse.com/security/cve/CVE-2019-14809.html https://www.suse.com/security/cve/CVE-2019-9512.html https://www.suse.com/security/cve/CVE-2019-9514.html https://bugzilla.suse.com/1139210 https://bugzilla.suse.com/1141689 https://bugzilla.suse.com/1146111 https://bugzilla.suse.com/1146115 https://bugzilla.suse.com/1146123 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2083-1: moderate: Security update for srt
by opensuse-security＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Security Update: Security update for srt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2083-1 Rating: moderate References: #1148844 Cross-References: CVE-2019-15784 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: srt was updated to version 1.3.4. Security issues fixed: * CVE-2019-15784: avoid a potential array overflow. (boo#1148844) * New binary: srt-tunnel * srt-multiplexer binary is now a testing application and thus is dropped from our package. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2083=1 Package List: - openSUSE Leap 15.1 (x86_64): libsrt1-1.3.4-lp151.2.3.1 libsrt1-debuginfo-1.3.4-lp151.2.3.1 srt-1.3.4-lp151.2.3.1 srt-debuginfo-1.3.4-lp151.2.3.1 srt-debugsource-1.3.4-lp151.2.3.1 srt-devel-1.3.4-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-15784.html https://bugzilla.suse.com/1148844 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2081-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2081-1 Rating: moderate References: #1146219 #1149143 Cross-References: CVE-2019-5869 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for chromium fixes the following issues: Security issues fixed: - CVE-2019-5869: Fixed use-after-free in Blink (boo#1149143). - Various fixes from internal audits, fuzzing and other initiatives. Non-security issues fixed: - Fixed no video playback on Intel Kaby Lake and later (boo#1146219). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2081=1 Package List: - openSUSE Leap 15.0 (x86_64): chromedriver-76.0.3809.132-lp150.234.1 chromedriver-debuginfo-76.0.3809.132-lp150.234.1 chromium-76.0.3809.132-lp150.234.1 chromium-debuginfo-76.0.3809.132-lp150.234.1 chromium-debugsource-76.0.3809.132-lp150.234.1 References: https://www.suse.com/security/cve/CVE-2019-5869.html https://bugzilla.suse.com/1146219 https://bugzilla.suse.com/1149143 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2080-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 07 Sep '19

07 Sep '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2080-1 Rating: moderate References: #1146219 #1149143 Cross-References: CVE-2019-5869 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for chromium fixes the following issues: Security issues fixed: - CVE-2019-5869: Fixed use-after-free in Blink (boo#1149143). - Various fixes from internal audits, fuzzing and other initiatives. Non-security issues fixed: - Fixed no video playback on Intel Kaby Lake and later (boo#1146219). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2080=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-76.0.3809.132-lp151.2.25.1 chromedriver-debuginfo-76.0.3809.132-lp151.2.25.1 chromium-76.0.3809.132-lp151.2.25.1 chromium-debuginfo-76.0.3809.132-lp151.2.25.1 chromium-debugsource-76.0.3809.132-lp151.2.25.1 References: https://www.suse.com/security/cve/CVE-2019-5869.html https://bugzilla.suse.com/1146219 https://bugzilla.suse.com/1149143 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2077-1: moderate: Security update for libmirage
by opensuse-security＠opensuse.org 06 Sep '19

06 Sep '19

openSUSE Security Update: Security update for libmirage ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2077-1 Rating: moderate References: #1148087 Cross-References: CVE-2019-15540 Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libmirage fixes the following issues: CVE-2019-15540: The CSO filter in libMirage in CDemu did not validate the part size, triggering a heap-based buffer overflow that could lead to root access by a local user. [boo#1148087] - Update to new upstream release 3.2.2 * ISO parser: fixed ISO9660/UDF pattern search for sector sizes 2332 and 2336. * ISO parser: added support for Nintendo GameCube and Wii ISO images. * Extended medium type guess to distinguish between DVD and BluRay images based on length. * Removed fabrication of disc structures from the library (moved to CDEmu daemon). * MDS parser: cleanup of disc structure parsing, fixed the incorrectly set structure sizes. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2077=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2077=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libmirage-3_2-3.2.2-bp151.4.3.1 libmirage-3_2-debuginfo-3.2.2-bp151.4.3.1 libmirage-debuginfo-3.2.2-bp151.4.3.1 libmirage-debugsource-3.2.2-bp151.4.3.1 libmirage-devel-3.2.2-bp151.4.3.1 libmirage11-3.2.2-bp151.4.3.1 libmirage11-debuginfo-3.2.2-bp151.4.3.1 typelib-1_0-libmirage-3_2-3.2.2-bp151.4.3.1 - openSUSE Backports SLE-15-SP1 (noarch): libmirage-data-3.2.2-bp151.4.3.1 libmirage-lang-3.2.2-bp151.4.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libmirage-3_2-3.2.2-bp150.3.3.1 libmirage-devel-3.2.2-bp150.3.3.1 libmirage11-3.2.2-bp150.3.3.1 typelib-1_0-libmirage-3_2-3.2.2-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): libmirage-data-3.2.2-bp150.3.3.1 libmirage-lang-3.2.2-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-15540.html https://bugzilla.suse.com/1148087 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2078-1: important: Security update for python-SQLAlchemy
by opensuse-security＠opensuse.org 06 Sep '19

06 Sep '19

openSUSE Security Update: Security update for python-SQLAlchemy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2078-1 Rating: important References: #1124593 Cross-References: CVE-2019-7164 CVE-2019-7548 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python-SQLAlchemy fixes the following issues: Security issues fixed: - CVE-2019-7164: Fixed SQL Injection via the order_by parameter (bsc#1124593). - CVE-2019-7548: Fixed SQL Injection via the group_by parameter (bsc#1124593). This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2078=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): python2-SQLAlchemy-1.2.7-bp150.2.3.1 python3-SQLAlchemy-1.2.7-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): python-SQLAlchemy-doc-1.2.7-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-7164.html https://www.suse.com/security/cve/CVE-2019-7548.html https://bugzilla.suse.com/1124593 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2067-1: Security update for wavpack
by opensuse-security＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Security Update: Security update for wavpack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2067-1 Rating: low References: #1133384 #1141334 Cross-References: CVE-2019-1010319 CVE-2019-11498 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for wavpack fixes the following issues: Security issues fixed: - CVE-2019-1010319: Fixed use of uninitialized variable in ParseWave64HeaderConfig that can result in unexpected control flow, crashes, and segfaults (bsc#1141334). - CVE-2019-11498: Fixed possible denial of service (application crash) in WavpackSetConfiguration64 via a DFF file that lacks valid sample-rate data (bsc#1133384). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2067=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2067=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libwavpack1-5.1.0-lp151.5.3.1 libwavpack1-debuginfo-5.1.0-lp151.5.3.1 wavpack-5.1.0-lp151.5.3.1 wavpack-debuginfo-5.1.0-lp151.5.3.1 wavpack-debugsource-5.1.0-lp151.5.3.1 wavpack-devel-5.1.0-lp151.5.3.1 - openSUSE Leap 15.1 (x86_64): libwavpack1-32bit-5.1.0-lp151.5.3.1 libwavpack1-32bit-debuginfo-5.1.0-lp151.5.3.1 - openSUSE Leap 15.0 (i586 x86_64): libwavpack1-5.1.0-lp150.3.6.1 libwavpack1-debuginfo-5.1.0-lp150.3.6.1 wavpack-5.1.0-lp150.3.6.1 wavpack-debuginfo-5.1.0-lp150.3.6.1 wavpack-debugsource-5.1.0-lp150.3.6.1 wavpack-devel-5.1.0-lp150.3.6.1 - openSUSE Leap 15.0 (x86_64): libwavpack1-32bit-5.1.0-lp150.3.6.1 libwavpack1-32bit-debuginfo-5.1.0-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-1010319.html https://www.suse.com/security/cve/CVE-2019-11498.html https://bugzilla.suse.com/1133384 https://bugzilla.suse.com/1141334 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0