September 2019 - openSUSE Security Announce

[security-announce] openSUSE-SU-2019:2071-1: moderate: Security update for SDL_image
by opensuse-security＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Security Update: Security update for SDL_image ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2071-1 Rating: moderate References: #1124827 #1140421 #1141844 #1143763 #1143764 #1143766 #1143768 Cross-References: CVE-2019-13616 CVE-2019-5052 CVE-2019-5057 CVE-2019-5058 CVE-2019-5059 CVE-2019-5060 CVE-2019-7635 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for SDL_image fixes the following issues: Update SDL_Image to new snapshot 1.2.12+hg695. Security issues fixed: * TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421) * TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763) * TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764) * TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image handling (boo#1143766) * TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768) * CVE-2019-7635: heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c (boo#1124827) * CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2071=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2071=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): SDL_image-debugsource-1.2.12+hg695-lp151.3.3.1 libSDL_image-1_2-0-1.2.12+hg695-lp151.3.3.1 libSDL_image-1_2-0-debuginfo-1.2.12+hg695-lp151.3.3.1 libSDL_image-devel-1.2.12+hg695-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libSDL_image-1_2-0-32bit-1.2.12+hg695-lp151.3.3.1 libSDL_image-1_2-0-32bit-debuginfo-1.2.12+hg695-lp151.3.3.1 libSDL_image-devel-32bit-1.2.12+hg695-lp151.3.3.1 - openSUSE Leap 15.0 (i586 x86_64): SDL_image-debugsource-1.2.12+hg695-lp150.2.3.1 libSDL_image-1_2-0-1.2.12+hg695-lp150.2.3.1 libSDL_image-1_2-0-debuginfo-1.2.12+hg695-lp150.2.3.1 libSDL_image-devel-1.2.12+hg695-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libSDL_image-1_2-0-32bit-1.2.12+hg695-lp150.2.3.1 libSDL_image-1_2-0-32bit-debuginfo-1.2.12+hg695-lp150.2.3.1 libSDL_image-devel-32bit-1.2.12+hg695-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-13616.html https://www.suse.com/security/cve/CVE-2019-5052.html https://www.suse.com/security/cve/CVE-2019-5057.html https://www.suse.com/security/cve/CVE-2019-5058.html https://www.suse.com/security/cve/CVE-2019-5059.html https://www.suse.com/security/cve/CVE-2019-5060.html https://www.suse.com/security/cve/CVE-2019-7635.html https://bugzilla.suse.com/1124827 https://bugzilla.suse.com/1140421 https://bugzilla.suse.com/1141844 https://bugzilla.suse.com/1143763 https://bugzilla.suse.com/1143764 https://bugzilla.suse.com/1143766 https://bugzilla.suse.com/1143768 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2068-1: moderate: Security update for python-Twisted
by opensuse-security＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Security Update: Security update for python-Twisted ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2068-1 Rating: moderate References: #1138461 Cross-References: CVE-2019-12855 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Twisted fixes the following issues: Security issue fixed: - CVE-2019-12855: Fixed TLS certificate verification to protecting against MITM attacks (bsc#1138461). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2068=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2068=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): python-Twisted-debuginfo-17.9.0-lp151.3.6.1 python-Twisted-debugsource-17.9.0-lp151.3.6.1 python-Twisted-doc-17.9.0-lp151.3.6.1 python2-Twisted-17.9.0-lp151.3.6.1 python2-Twisted-debuginfo-17.9.0-lp151.3.6.1 python3-Twisted-17.9.0-lp151.3.6.1 python3-Twisted-debuginfo-17.9.0-lp151.3.6.1 - openSUSE Leap 15.0 (i586 x86_64): python-Twisted-debuginfo-17.9.0-lp150.2.6.1 python-Twisted-debugsource-17.9.0-lp150.2.6.1 python-Twisted-doc-17.9.0-lp150.2.6.1 python2-Twisted-17.9.0-lp150.2.6.1 python2-Twisted-debuginfo-17.9.0-lp150.2.6.1 python3-Twisted-17.9.0-lp150.2.6.1 python3-Twisted-debuginfo-17.9.0-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-12855.html https://bugzilla.suse.com/1138461 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2070-1: moderate: Security update for SDL2_image
by opensuse-security＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Security Update: Security update for SDL2_image ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2070-1 Rating: moderate References: #1135787 #1135789 #1135796 #1135806 #1136101 #1140419 #1140421 #1141844 #1143763 #1143764 #1143766 #1143768 Cross-References: CVE-2019-12217 CVE-2019-12218 CVE-2019-12220 CVE-2019-12221 CVE-2019-12222 CVE-2019-13616 CVE-2019-5051 CVE-2019-5052 CVE-2019-5057 CVE-2019-5058 CVE-2019-5059 CVE-2019-5060 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for SDL2_image fixes the following issues: Update to new upstream release 2.0.5. Security issues fixed: * TALOS-2019-0820 CVE-2019-5051: exploitable heap-based buffer overflow vulnerability when loading a PCX file (boo#1140419) * TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421) * TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763) * TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764) * TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image (boo#1143766) * TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768) Not mentioned by upstream, but issues seemingly further fixed: * CVE-2019-12218: NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW (boo#1135789) * CVE-2019-12217: NULL pointer dereference in the SDL stdio_read function (boo#1135787) * CVE-2019-12220: SDL_image triggers an out-of-bounds read in the SDL function SDL_FreePalette_REAL (boo#1135806) * CVE-2019-12221: a SEGV caused by SDL_image in SDL function SDL_free_REAL in stdlib/SDL_malloc.c (boo#1135796) * CVE-2019-12222: out-of-bounds read triggered by SDL_image in the function SDL_InvalidateMap at video/SDL_pixels.c (boo#1136101) * CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2070=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2070=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): SDL2_image-debugsource-2.0.5-lp151.2.5.1 libSDL2_image-2_0-0-2.0.5-lp151.2.5.1 libSDL2_image-2_0-0-debuginfo-2.0.5-lp151.2.5.1 libSDL2_image-devel-2.0.5-lp151.2.5.1 - openSUSE Leap 15.1 (x86_64): libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1 libSDL2_image-2_0-0-32bit-debuginfo-2.0.5-lp151.2.5.1 libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1 - openSUSE Leap 15.0 (i586 x86_64): SDL2_image-debugsource-2.0.5-lp150.9.1 libSDL2_image-2_0-0-2.0.5-lp150.9.1 libSDL2_image-2_0-0-debuginfo-2.0.5-lp150.9.1 libSDL2_image-devel-2.0.5-lp150.9.1 - openSUSE Leap 15.0 (x86_64): libSDL2_image-2_0-0-32bit-2.0.5-lp150.9.1 libSDL2_image-2_0-0-32bit-debuginfo-2.0.5-lp150.9.1 libSDL2_image-devel-32bit-2.0.5-lp150.9.1 References: https://www.suse.com/security/cve/CVE-2019-12217.html https://www.suse.com/security/cve/CVE-2019-12218.html https://www.suse.com/security/cve/CVE-2019-12220.html https://www.suse.com/security/cve/CVE-2019-12221.html https://www.suse.com/security/cve/CVE-2019-12222.html https://www.suse.com/security/cve/CVE-2019-13616.html https://www.suse.com/security/cve/CVE-2019-5051.html https://www.suse.com/security/cve/CVE-2019-5052.html https://www.suse.com/security/cve/CVE-2019-5057.html https://www.suse.com/security/cve/CVE-2019-5058.html https://www.suse.com/security/cve/CVE-2019-5059.html https://www.suse.com/security/cve/CVE-2019-5060.html https://bugzilla.suse.com/1135787 https://bugzilla.suse.com/1135789 https://bugzilla.suse.com/1135796 https://bugzilla.suse.com/1135806 https://bugzilla.suse.com/1136101 https://bugzilla.suse.com/1140419 https://bugzilla.suse.com/1140421 https://bugzilla.suse.com/1141844 https://bugzilla.suse.com/1143763 https://bugzilla.suse.com/1143764 https://bugzilla.suse.com/1143766 https://bugzilla.suse.com/1143768 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2072-1: moderate: Security update for go1.11
by opensuse-security＠opensuse.org 05 Sep '19

05 Sep '19

openSUSE Security Update: Security update for go1.11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2072-1 Rating: moderate References: #1141688 #1146111 #1146115 #1146123 Cross-References: CVE-2019-14809 CVE-2019-9512 CVE-2019-9514 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for go1.11 fixes the following issues: Security issues fixed: - CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111). - CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115). - CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123). Bugfixes: - Update to go version 1.11.13 (bsc#1141688). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2072=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2072=1 Package List: - openSUSE Leap 15.1 (x86_64): go1.11-1.11.13-lp151.2.9.1 go1.11-doc-1.11.13-lp151.2.9.1 go1.11-race-1.11.13-lp151.2.9.1 - openSUSE Leap 15.0 (x86_64): go1.11-1.11.13-lp150.18.1 go1.11-doc-1.11.13-lp150.18.1 go1.11-race-1.11.13-lp150.18.1 References: https://www.suse.com/security/cve/CVE-2019-14809.html https://www.suse.com/security/cve/CVE-2019-9512.html https://www.suse.com/security/cve/CVE-2019-9514.html https://bugzilla.suse.com/1141688 https://bugzilla.suse.com/1146111 https://bugzilla.suse.com/1146115 https://bugzilla.suse.com/1146123 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2064-1: important: Security update for python-SQLAlchemy
by opensuse-security＠opensuse.org 04 Sep '19

04 Sep '19

openSUSE Security Update: Security update for python-SQLAlchemy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2064-1 Rating: important References: #1124593 Cross-References: CVE-2019-7164 CVE-2019-7548 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python-SQLAlchemy fixes the following issues: Security issues fixed: - CVE-2019-7164: Fixed SQL Injection via the order_by parameter (bsc#1124593). - CVE-2019-7548: Fixed SQL Injection via the group_by parameter (bsc#1124593). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2064=1 Package List: - openSUSE Leap 15.1 (noarch): python-SQLAlchemy-doc-1.2.14-lp151.2.3.1 - openSUSE Leap 15.1 (x86_64): python-SQLAlchemy-debuginfo-1.2.14-lp151.2.3.1 python-SQLAlchemy-debugsource-1.2.14-lp151.2.3.1 python2-SQLAlchemy-1.2.14-lp151.2.3.1 python2-SQLAlchemy-debuginfo-1.2.14-lp151.2.3.1 python3-SQLAlchemy-1.2.14-lp151.2.3.1 python3-SQLAlchemy-debuginfo-1.2.14-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-7164.html https://www.suse.com/security/cve/CVE-2019-7548.html https://bugzilla.suse.com/1124593 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2062-1: important: Security update for postgresql10
by opensuse-security＠opensuse.org 03 Sep '19

03 Sep '19

openSUSE Security Update: Security update for postgresql10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2062-1 Rating: important References: #1145092 Cross-References: CVE-2019-10208 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql10 fixes the following issues: Security issue fixed: - CVE-2019-10208: Fixed arbitrary SQL execution via suitable SECURITY DEFINER function under the identity of the function owner (bsc#1145092). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2062=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2062=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libecpg6-10.10-lp151.2.6.1 libecpg6-debuginfo-10.10-lp151.2.6.1 libpq5-10.10-lp151.2.6.1 libpq5-debuginfo-10.10-lp151.2.6.1 postgresql10-10.10-lp151.2.6.1 postgresql10-contrib-10.10-lp151.2.6.1 postgresql10-contrib-debuginfo-10.10-lp151.2.6.1 postgresql10-debuginfo-10.10-lp151.2.6.1 postgresql10-debugsource-10.10-lp151.2.6.1 postgresql10-devel-10.10-lp151.2.6.1 postgresql10-devel-debuginfo-10.10-lp151.2.6.1 postgresql10-plperl-10.10-lp151.2.6.1 postgresql10-plperl-debuginfo-10.10-lp151.2.6.1 postgresql10-plpython-10.10-lp151.2.6.1 postgresql10-plpython-debuginfo-10.10-lp151.2.6.1 postgresql10-pltcl-10.10-lp151.2.6.1 postgresql10-pltcl-debuginfo-10.10-lp151.2.6.1 postgresql10-server-10.10-lp151.2.6.1 postgresql10-server-debuginfo-10.10-lp151.2.6.1 postgresql10-test-10.10-lp151.2.6.1 - openSUSE Leap 15.1 (x86_64): libecpg6-32bit-10.10-lp151.2.6.1 libecpg6-32bit-debuginfo-10.10-lp151.2.6.1 libpq5-32bit-10.10-lp151.2.6.1 libpq5-32bit-debuginfo-10.10-lp151.2.6.1 - openSUSE Leap 15.1 (noarch): postgresql10-docs-10.10-lp151.2.6.1 - openSUSE Leap 15.0 (i586 x86_64): libecpg6-10.10-lp150.3.13.1 libecpg6-debuginfo-10.10-lp150.3.13.1 libpq5-10.10-lp150.3.13.1 libpq5-debuginfo-10.10-lp150.3.13.1 postgresql10-10.10-lp150.3.13.1 postgresql10-contrib-10.10-lp150.3.13.1 postgresql10-contrib-debuginfo-10.10-lp150.3.13.1 postgresql10-debuginfo-10.10-lp150.3.13.1 postgresql10-debugsource-10.10-lp150.3.13.1 postgresql10-devel-10.10-lp150.3.13.1 postgresql10-devel-debuginfo-10.10-lp150.3.13.1 postgresql10-plperl-10.10-lp150.3.13.1 postgresql10-plperl-debuginfo-10.10-lp150.3.13.1 postgresql10-plpython-10.10-lp150.3.13.1 postgresql10-plpython-debuginfo-10.10-lp150.3.13.1 postgresql10-pltcl-10.10-lp150.3.13.1 postgresql10-pltcl-debuginfo-10.10-lp150.3.13.1 postgresql10-server-10.10-lp150.3.13.1 postgresql10-server-debuginfo-10.10-lp150.3.13.1 postgresql10-test-10.10-lp150.3.13.1 - openSUSE Leap 15.0 (x86_64): libecpg6-32bit-10.10-lp150.3.13.1 libecpg6-32bit-debuginfo-10.10-lp150.3.13.1 libpq5-32bit-10.10-lp150.3.13.1 libpq5-32bit-debuginfo-10.10-lp150.3.13.1 - openSUSE Leap 15.0 (noarch): postgresql10-docs-10.10-lp150.3.13.1 References: https://www.suse.com/security/cve/CVE-2019-10208.html https://bugzilla.suse.com/1145092 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2059-1: important: Security update for qemu
by opensuse-security＠opensuse.org 03 Sep '19

03 Sep '19

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2059-1 Rating: important References: #1079730 #1098403 #1111025 #1119115 #1134883 #1135902 #1136540 #1136778 #1140402 #1143794 Cross-References: CVE-2019-12155 CVE-2019-13164 CVE-2019-14378 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has 7 fixes is now available. Description: This update for qemu fixes the following issues: Security issues fixed: - CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794). - CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902). - CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402). Bug fixes and enhancements: - Add vcpu features needed for Cascadelake-Server, Icelake-Client and Icelake-Server, especially the foundational arch-capabilities to help with security and performance on Intel hosts (bsc#1134883) (fate#327764) - Add support for one more security/performance related vcpu feature (bsc#1136778) (fate#327796) - Disable file locking in the Xen PV disk backend to avoid locking issues with PV domUs during migration. The issues triggered by the locking can not be properly handled in libxl. The locking introduced in qemu-2.10 was removed again in qemu-4.0 (bsc#1079730, bsc#1098403, bsc#1111025). - Ignore csske for expanding the cpu model (bsc#1136540) - Fix vm migration is failing with input/output error when nfs server is disconnected (bsc#1119115) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2059=1 Package List: - openSUSE Leap 15.0 (x86_64): qemu-2.11.2-lp150.7.25.1 qemu-arm-2.11.2-lp150.7.25.1 qemu-arm-debuginfo-2.11.2-lp150.7.25.1 qemu-block-curl-2.11.2-lp150.7.25.1 qemu-block-curl-debuginfo-2.11.2-lp150.7.25.1 qemu-block-dmg-2.11.2-lp150.7.25.1 qemu-block-dmg-debuginfo-2.11.2-lp150.7.25.1 qemu-block-gluster-2.11.2-lp150.7.25.1 qemu-block-gluster-debuginfo-2.11.2-lp150.7.25.1 qemu-block-iscsi-2.11.2-lp150.7.25.1 qemu-block-iscsi-debuginfo-2.11.2-lp150.7.25.1 qemu-block-rbd-2.11.2-lp150.7.25.1 qemu-block-rbd-debuginfo-2.11.2-lp150.7.25.1 qemu-block-ssh-2.11.2-lp150.7.25.1 qemu-block-ssh-debuginfo-2.11.2-lp150.7.25.1 qemu-debuginfo-2.11.2-lp150.7.25.1 qemu-debugsource-2.11.2-lp150.7.25.1 qemu-extra-2.11.2-lp150.7.25.1 qemu-extra-debuginfo-2.11.2-lp150.7.25.1 qemu-guest-agent-2.11.2-lp150.7.25.1 qemu-guest-agent-debuginfo-2.11.2-lp150.7.25.1 qemu-ksm-2.11.2-lp150.7.25.1 qemu-kvm-2.11.2-lp150.7.25.1 qemu-lang-2.11.2-lp150.7.25.1 qemu-ppc-2.11.2-lp150.7.25.1 qemu-ppc-debuginfo-2.11.2-lp150.7.25.1 qemu-s390-2.11.2-lp150.7.25.1 qemu-s390-debuginfo-2.11.2-lp150.7.25.1 qemu-tools-2.11.2-lp150.7.25.1 qemu-tools-debuginfo-2.11.2-lp150.7.25.1 qemu-x86-2.11.2-lp150.7.25.1 qemu-x86-debuginfo-2.11.2-lp150.7.25.1 - openSUSE Leap 15.0 (noarch): qemu-ipxe-1.0.0+-lp150.7.25.1 qemu-seabios-1.11.0-lp150.7.25.1 qemu-sgabios-8-lp150.7.25.1 qemu-vgabios-1.11.0-lp150.7.25.1 References: https://www.suse.com/security/cve/CVE-2019-12155.html https://www.suse.com/security/cve/CVE-2019-13164.html https://www.suse.com/security/cve/CVE-2019-14378.html https://bugzilla.suse.com/1079730 https://bugzilla.suse.com/1098403 https://bugzilla.suse.com/1111025 https://bugzilla.suse.com/1119115 https://bugzilla.suse.com/1134883 https://bugzilla.suse.com/1135902 https://bugzilla.suse.com/1136540 https://bugzilla.suse.com/1136778 https://bugzilla.suse.com/1140402 https://bugzilla.suse.com/1143794 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2058-1: important: Security update for apache-commons-beanutils
by opensuse-security＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Security Update: Security update for apache-commons-beanutils ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2058-1 Rating: important References: #1146657 Cross-References: CVE-2019-10086 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for apache-commons-beanutils fixes the following issues: Security issue fixed: - CVE-2019-10086: Added special BeanIntrospector class which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects (bsc#1146657). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2058=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2058=1 Package List: - openSUSE Leap 15.1 (noarch): apache-commons-beanutils-1.9.2-lp151.3.3.1 apache-commons-beanutils-javadoc-1.9.2-lp151.3.3.1 - openSUSE Leap 15.0 (noarch): apache-commons-beanutils-1.9.2-lp150.2.3.1 apache-commons-beanutils-javadoc-1.9.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-10086.html https://bugzilla.suse.com/1146657 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2057-1: important: Security update for libreoffice
by opensuse-security＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Security Update: Security update for libreoffice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2057-1 Rating: important References: #1133534 #1141861 #1141862 #1146098 #1146105 #1146107 Cross-References: CVE-2019-9848 CVE-2019-9849 CVE-2019-9850 CVE-2019-9851 CVE-2019-9852 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for libreoffice fixes the following issues: Security issues fixed: - CVE-2019-9849: Disabled fetching remote bullet graphics in 'stealth mode' (bsc#1141861). - CVE-2019-9848: Fixed an arbitrary script execution via LibreLogo (bsc#1141862). - CVE-2019-9851: Fixed LibreLogo global-event script execution issue (bsc#1146105). - CVE-2019-9852: Fixed insufficient URL encoding flaw in allowed script location check (bsc#1146107). - CVE-2019-9850: Fixed insufficient URL validation that allowed LibreLogo script execution (bsc#1146098). Non-security issue fixed: - SmartArt: Basic rendering of Trapezoid List (bsc#1133534) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2057=1 Package List: - openSUSE Leap 15.0 (noarch): libreoffice-branding-upstream-6.2.6.2-lp150.2.16.1 libreoffice-gdb-pretty-printers-6.2.6.2-lp150.2.16.1 libreoffice-glade-6.2.6.2-lp150.2.16.1 libreoffice-icon-themes-6.2.6.2-lp150.2.16.1 libreoffice-l10n-af-6.2.6.2-lp150.2.16.1 libreoffice-l10n-am-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ar-6.2.6.2-lp150.2.16.1 libreoffice-l10n-as-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ast-6.2.6.2-lp150.2.16.1 libreoffice-l10n-be-6.2.6.2-lp150.2.16.1 libreoffice-l10n-bg-6.2.6.2-lp150.2.16.1 libreoffice-l10n-bn-6.2.6.2-lp150.2.16.1 libreoffice-l10n-bn_IN-6.2.6.2-lp150.2.16.1 libreoffice-l10n-bo-6.2.6.2-lp150.2.16.1 libreoffice-l10n-br-6.2.6.2-lp150.2.16.1 libreoffice-l10n-brx-6.2.6.2-lp150.2.16.1 libreoffice-l10n-bs-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ca-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ca_valencia-6.2.6.2-lp150.2.16.1 libreoffice-l10n-cs-6.2.6.2-lp150.2.16.1 libreoffice-l10n-cy-6.2.6.2-lp150.2.16.1 libreoffice-l10n-da-6.2.6.2-lp150.2.16.1 libreoffice-l10n-de-6.2.6.2-lp150.2.16.1 libreoffice-l10n-dgo-6.2.6.2-lp150.2.16.1 libreoffice-l10n-dsb-6.2.6.2-lp150.2.16.1 libreoffice-l10n-dz-6.2.6.2-lp150.2.16.1 libreoffice-l10n-el-6.2.6.2-lp150.2.16.1 libreoffice-l10n-en-6.2.6.2-lp150.2.16.1 libreoffice-l10n-en_GB-6.2.6.2-lp150.2.16.1 libreoffice-l10n-en_ZA-6.2.6.2-lp150.2.16.1 libreoffice-l10n-eo-6.2.6.2-lp150.2.16.1 libreoffice-l10n-es-6.2.6.2-lp150.2.16.1 libreoffice-l10n-et-6.2.6.2-lp150.2.16.1 libreoffice-l10n-eu-6.2.6.2-lp150.2.16.1 libreoffice-l10n-fa-6.2.6.2-lp150.2.16.1 libreoffice-l10n-fi-6.2.6.2-lp150.2.16.1 libreoffice-l10n-fr-6.2.6.2-lp150.2.16.1 libreoffice-l10n-fy-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ga-6.2.6.2-lp150.2.16.1 libreoffice-l10n-gd-6.2.6.2-lp150.2.16.1 libreoffice-l10n-gl-6.2.6.2-lp150.2.16.1 libreoffice-l10n-gu-6.2.6.2-lp150.2.16.1 libreoffice-l10n-gug-6.2.6.2-lp150.2.16.1 libreoffice-l10n-he-6.2.6.2-lp150.2.16.1 libreoffice-l10n-hi-6.2.6.2-lp150.2.16.1 libreoffice-l10n-hr-6.2.6.2-lp150.2.16.1 libreoffice-l10n-hsb-6.2.6.2-lp150.2.16.1 libreoffice-l10n-hu-6.2.6.2-lp150.2.16.1 libreoffice-l10n-id-6.2.6.2-lp150.2.16.1 libreoffice-l10n-is-6.2.6.2-lp150.2.16.1 libreoffice-l10n-it-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ja-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ka-6.2.6.2-lp150.2.16.1 libreoffice-l10n-kab-6.2.6.2-lp150.2.16.1 libreoffice-l10n-kk-6.2.6.2-lp150.2.16.1 libreoffice-l10n-km-6.2.6.2-lp150.2.16.1 libreoffice-l10n-kmr_Latn-6.2.6.2-lp150.2.16.1 libreoffice-l10n-kn-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ko-6.2.6.2-lp150.2.16.1 libreoffice-l10n-kok-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ks-6.2.6.2-lp150.2.16.1 libreoffice-l10n-lb-6.2.6.2-lp150.2.16.1 libreoffice-l10n-lo-6.2.6.2-lp150.2.16.1 libreoffice-l10n-lt-6.2.6.2-lp150.2.16.1 libreoffice-l10n-lv-6.2.6.2-lp150.2.16.1 libreoffice-l10n-mai-6.2.6.2-lp150.2.16.1 libreoffice-l10n-mk-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ml-6.2.6.2-lp150.2.16.1 libreoffice-l10n-mn-6.2.6.2-lp150.2.16.1 libreoffice-l10n-mni-6.2.6.2-lp150.2.16.1 libreoffice-l10n-mr-6.2.6.2-lp150.2.16.1 libreoffice-l10n-my-6.2.6.2-lp150.2.16.1 libreoffice-l10n-nb-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ne-6.2.6.2-lp150.2.16.1 libreoffice-l10n-nl-6.2.6.2-lp150.2.16.1 libreoffice-l10n-nn-6.2.6.2-lp150.2.16.1 libreoffice-l10n-nr-6.2.6.2-lp150.2.16.1 libreoffice-l10n-nso-6.2.6.2-lp150.2.16.1 libreoffice-l10n-oc-6.2.6.2-lp150.2.16.1 libreoffice-l10n-om-6.2.6.2-lp150.2.16.1 libreoffice-l10n-or-6.2.6.2-lp150.2.16.1 libreoffice-l10n-pa-6.2.6.2-lp150.2.16.1 libreoffice-l10n-pl-6.2.6.2-lp150.2.16.1 libreoffice-l10n-pt_BR-6.2.6.2-lp150.2.16.1 libreoffice-l10n-pt_PT-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ro-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ru-6.2.6.2-lp150.2.16.1 libreoffice-l10n-rw-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sa_IN-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sat-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sd-6.2.6.2-lp150.2.16.1 libreoffice-l10n-si-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sid-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sk-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sl-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sq-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sr-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ss-6.2.6.2-lp150.2.16.1 libreoffice-l10n-st-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sv-6.2.6.2-lp150.2.16.1 libreoffice-l10n-sw_TZ-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ta-6.2.6.2-lp150.2.16.1 libreoffice-l10n-te-6.2.6.2-lp150.2.16.1 libreoffice-l10n-tg-6.2.6.2-lp150.2.16.1 libreoffice-l10n-th-6.2.6.2-lp150.2.16.1 libreoffice-l10n-tn-6.2.6.2-lp150.2.16.1 libreoffice-l10n-tr-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ts-6.2.6.2-lp150.2.16.1 libreoffice-l10n-tt-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ug-6.2.6.2-lp150.2.16.1 libreoffice-l10n-uk-6.2.6.2-lp150.2.16.1 libreoffice-l10n-uz-6.2.6.2-lp150.2.16.1 libreoffice-l10n-ve-6.2.6.2-lp150.2.16.1 libreoffice-l10n-vec-6.2.6.2-lp150.2.16.1 libreoffice-l10n-vi-6.2.6.2-lp150.2.16.1 libreoffice-l10n-xh-6.2.6.2-lp150.2.16.1 libreoffice-l10n-zh_CN-6.2.6.2-lp150.2.16.1 libreoffice-l10n-zh_TW-6.2.6.2-lp150.2.16.1 libreoffice-l10n-zu-6.2.6.2-lp150.2.16.1 - openSUSE Leap 15.0 (x86_64): libreoffice-6.2.6.2-lp150.2.16.1 libreoffice-base-6.2.6.2-lp150.2.16.1 libreoffice-base-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-base-drivers-firebird-6.2.6.2-lp150.2.16.1 libreoffice-base-drivers-firebird-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-base-drivers-postgresql-6.2.6.2-lp150.2.16.1 libreoffice-base-drivers-postgresql-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-calc-6.2.6.2-lp150.2.16.1 libreoffice-calc-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-calc-extensions-6.2.6.2-lp150.2.16.1 libreoffice-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-debugsource-6.2.6.2-lp150.2.16.1 libreoffice-draw-6.2.6.2-lp150.2.16.1 libreoffice-draw-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-filters-optional-6.2.6.2-lp150.2.16.1 libreoffice-gnome-6.2.6.2-lp150.2.16.1 libreoffice-gnome-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-gtk2-6.2.6.2-lp150.2.16.1 libreoffice-gtk2-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-gtk3-6.2.6.2-lp150.2.16.1 libreoffice-gtk3-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-impress-6.2.6.2-lp150.2.16.1 libreoffice-impress-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-mailmerge-6.2.6.2-lp150.2.16.1 libreoffice-math-6.2.6.2-lp150.2.16.1 libreoffice-math-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-officebean-6.2.6.2-lp150.2.16.1 libreoffice-officebean-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-pyuno-6.2.6.2-lp150.2.16.1 libreoffice-pyuno-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-qt5-6.2.6.2-lp150.2.16.1 libreoffice-qt5-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-sdk-6.2.6.2-lp150.2.16.1 libreoffice-sdk-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-sdk-doc-6.2.6.2-lp150.2.16.1 libreoffice-writer-6.2.6.2-lp150.2.16.1 libreoffice-writer-debuginfo-6.2.6.2-lp150.2.16.1 libreoffice-writer-extensions-6.2.6.2-lp150.2.16.1 libreofficekit-6.2.6.2-lp150.2.16.1 libreofficekit-devel-6.2.6.2-lp150.2.16.1 References: https://www.suse.com/security/cve/CVE-2019-9848.html https://www.suse.com/security/cve/CVE-2019-9849.html https://www.suse.com/security/cve/CVE-2019-9850.html https://www.suse.com/security/cve/CVE-2019-9851.html https://www.suse.com/security/cve/CVE-2019-9852.html https://bugzilla.suse.com/1133534 https://bugzilla.suse.com/1141861 https://bugzilla.suse.com/1141862 https://bugzilla.suse.com/1146098 https://bugzilla.suse.com/1146105 https://bugzilla.suse.com/1146107 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2019:2052-1: important: Security update for slurm
by opensuse-security＠opensuse.org 02 Sep '19

02 Sep '19

openSUSE Security Update: Security update for slurm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2052-1 Rating: important References: #1140709 Cross-References: CVE-2019-12838 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for slurm to version 18.08.8 fixes the following issues: Security issue fixed: - CVE-2019-12838: Fixed a SQL injection in slurmdbd (bsc#1140709). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2052=1 Package List: - openSUSE Leap 15.1 (x86_64): libpmi0-18.08.8-lp151.2.3.1 libpmi0-debuginfo-18.08.8-lp151.2.3.1 libslurm33-18.08.8-lp151.2.3.1 libslurm33-debuginfo-18.08.8-lp151.2.3.1 perl-slurm-18.08.8-lp151.2.3.1 perl-slurm-debuginfo-18.08.8-lp151.2.3.1 slurm-18.08.8-lp151.2.3.1 slurm-auth-none-18.08.8-lp151.2.3.1 slurm-auth-none-debuginfo-18.08.8-lp151.2.3.1 slurm-config-18.08.8-lp151.2.3.1 slurm-config-man-18.08.8-lp151.2.3.1 slurm-cray-18.08.8-lp151.2.3.1 slurm-cray-debuginfo-18.08.8-lp151.2.3.1 slurm-debuginfo-18.08.8-lp151.2.3.1 slurm-debugsource-18.08.8-lp151.2.3.1 slurm-devel-18.08.8-lp151.2.3.1 slurm-doc-18.08.8-lp151.2.3.1 slurm-hdf5-18.08.8-lp151.2.3.1 slurm-hdf5-debuginfo-18.08.8-lp151.2.3.1 slurm-lua-18.08.8-lp151.2.3.1 slurm-lua-debuginfo-18.08.8-lp151.2.3.1 slurm-munge-18.08.8-lp151.2.3.1 slurm-munge-debuginfo-18.08.8-lp151.2.3.1 slurm-node-18.08.8-lp151.2.3.1 slurm-node-debuginfo-18.08.8-lp151.2.3.1 slurm-openlava-18.08.8-lp151.2.3.1 slurm-pam_slurm-18.08.8-lp151.2.3.1 slurm-pam_slurm-debuginfo-18.08.8-lp151.2.3.1 slurm-plugins-18.08.8-lp151.2.3.1 slurm-plugins-debuginfo-18.08.8-lp151.2.3.1 slurm-seff-18.08.8-lp151.2.3.1 slurm-sjstat-18.08.8-lp151.2.3.1 slurm-slurmdbd-18.08.8-lp151.2.3.1 slurm-slurmdbd-debuginfo-18.08.8-lp151.2.3.1 slurm-sql-18.08.8-lp151.2.3.1 slurm-sql-debuginfo-18.08.8-lp151.2.3.1 slurm-sview-18.08.8-lp151.2.3.1 slurm-sview-debuginfo-18.08.8-lp151.2.3.1 slurm-torque-18.08.8-lp151.2.3.1 slurm-torque-debuginfo-18.08.8-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-12838.html https://bugzilla.suse.com/1140709 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0