September 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:2808-1: moderate: Recommended update for bleachbit
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for bleachbit ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2808-1 Rating: moderate References: #1104093 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for bleachbit fixes the following issues: - Add missing runtime dependency on python-xml (boo#1104093). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-881=1 Package List: - openSUSE Backports SLE-15 (noarch): bleachbit-2.0-bp150.3.3.1 bleachbit-lang-2.0-bp150.3.3.1 References: https://bugzilla.suse.com/1104093

1 0

openSUSE-SU-2018:2807-1: important: Security update for seamonkey
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for seamonkey ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2807-1 Rating: important References: #1020631 #1062195 #1076907 #1077291 #1098998 Cross-References: CVE-2018-12359 CVE-2018-12360 CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365 CVE-2018-12366 CVE-2018-5156 CVE-2018-5188 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for seamonkey fixes the following issues: Mozilla Seamonkey was updated to 2.49.4: Now uses Gecko 52.9.1esr (boo#1098998). Security issues fixed with MFSA 2018-16 (boo#1098998): * CVE-2018-12359: Buffer overflow using computed size of canvas element * CVE-2018-12360: Use-after-free when using focus() * CVE-2018-12362: Integer overflow in SSSE3 scaler * CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture * CVE-2018-12363: Use-after-free when appending DOM nodes * CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins * CVE-2018-12365: Compromised IPC child process can list local filenames * CVE-2018-12366: Invalid data handling during QCMS transformations * CVE-2018-5188: Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9 Localizations finally included again (boo#1062195) Updated summary and description to more accurately reflect what SeaMonkey is, giving less prominence to the long- discontinued Mozilla Application Suite that many users may no longer be familiar with Update to Seamonkey 2.49.2 * Gecko 52.6esr (including security relevant fixes) (boo#1077291) * fix issue in Composer * With some themes, the menulist- and history-dropmarker didn't show * Scrollbars didn't show the buttons * WebRTC has been disabled by default. It needs an add-on to enable it per site * The active title bar was not visually emphasized Correct requires and provides handling (boo#1076907) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-873=1 Package List: - openSUSE Backports SLE-15 (aarch64 x86_64): seamonkey-2.49.4-bp150.3.3.1 seamonkey-debuginfo-2.49.4-bp150.3.3.1 seamonkey-debugsource-2.49.4-bp150.3.3.1 seamonkey-translations-common-2.49.4-bp150.3.3.1 seamonkey-translations-other-2.49.4-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-12359.html https://www.suse.com/security/cve/CVE-2018-12360.html https://www.suse.com/security/cve/CVE-2018-12362.html https://www.suse.com/security/cve/CVE-2018-12363.html https://www.suse.com/security/cve/CVE-2018-12364.html https://www.suse.com/security/cve/CVE-2018-12365.html https://www.suse.com/security/cve/CVE-2018-12366.html https://www.suse.com/security/cve/CVE-2018-5156.html https://www.suse.com/security/cve/CVE-2018-5188.html https://bugzilla.suse.com/1020631 https://bugzilla.suse.com/1062195 https://bugzilla.suse.com/1076907 https://bugzilla.suse.com/1077291 https://bugzilla.suse.com/1098998

1 0

openSUSE-RU-2018:2710-2: moderate: Recommended update for gnuhealth, proteus, tryton, trytond, trytond_purchase, trytond_stock_supply
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for gnuhealth, proteus, tryton, trytond, trytond_purchase, trytond_stock_supply ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2710-2 Rating: moderate References: #1107771 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gnuhealth, proteus, tryton, trytond, trytond_purchase, trytond_stock_supply fixes the following issues (boo#1107771): Package: gnuhealth - Adding a dummy executable called 'gnuhealth' with some help text Package: proteus - Update to version 4.2.4 - this update provides fixes for several bugs Package: tryton - Update to version 4.2.17 - this update provides fixes for several bugs Package: trytond - Update to version 4.2.15 - this update provides fixes for several bugs Package: trytond_purchase - Update to version 4.2.6 - this update provides fixes for several bugs Package: trytond_stock_supply - Update to version 4.2.2 - this update provides fixes for several bugs Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-1000=1 Package List: - openSUSE Backports SLE-15 (noarch): gnuhealth-3.2.10-bp150.3.3.1 proteus-4.2.4-bp150.2.3.1 tryton-4.2.17-bp150.2.3.1 trytond-4.2.15-bp150.2.3.1 trytond_purchase-4.2.6-bp150.3.3.1 trytond_stock_supply-4.2.2-bp150.3.3.1 References: https://bugzilla.suse.com/1107771

1 0

openSUSE-RU-2018:2661-2: moderate: Recommended update for lastpass-cli
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for lastpass-cli ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2661-2 Rating: moderate References: #1107384 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for lastpass-cli fixes the following issues: - lastpass-cli was unable to verify the peer certificate due to a server-side change (boo#1107384) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-987=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): lastpass-cli-1.3.1-bp150.3.3.1 References: https://bugzilla.suse.com/1107384

1 0

openSUSE-RU-2018:2558-2: moderate: Recommended update for datovka, libisds
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for datovka, libisds ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2558-2 Rating: moderate References: #1104620 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for datovka, libisds provides continued functionality with the Czech e-gov communication system (bsc#1104620) Changes in datovka (updated to 4.10.3): - UI changes and fixes - Improved keyboard-based control of main and other dialogue windows. - Improved handling of ISDS error codes - Improved handling of unknown message types Changes in libisds (updated to 0.10.8): - Various memory leaks fixed - Recognise EV8 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-944=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): datovka-4.10.3-bp150.3.3.1 libisds-debugsource-0.10.8-bp150.3.3.1 libisds-devel-0.10.8-bp150.3.3.1 libisds5-0.10.8-bp150.3.3.1 libisds5-debuginfo-0.10.8-bp150.3.3.1 References: https://bugzilla.suse.com/1104620

1 0

openSUSE-RU-2018:2417-2: moderate: Recommended update for libebml
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for libebml ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2417-2 Rating: moderate References: #1104354 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libebml fixes the following issues: Updates libebml to version 1.3.6 Fixes boo#1104354 memory leaks and other issues with undefined behaviour Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-897=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libebml-debugsource-1.3.6-bp150.3.3.1 libebml-devel-1.3.6-bp150.3.3.1 libebml4-1.3.6-bp150.3.3.1 libebml4-debuginfo-1.3.6-bp150.3.3.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libebml4-64bit-1.3.6-bp150.3.3.1 libebml4-64bit-debuginfo-1.3.6-bp150.3.3.1 References: https://bugzilla.suse.com/1104354

1 0

openSUSE-SU-2018:2525-2: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2525-2 Rating: moderate References: #1105726 Cross-References: CVE-2018-15605 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for phpMyAdmin to version 4.8.3 addresses multiple issues. Security issues fixed: - CVE-2018-15605: vulnerability in the file import feature allowed cross-site scripting via importing a specially-crafted file (PMASA-2018-5, boo#1105726) This update also contains a number of upstream bug fixes in the UI and behavior. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-939=1 Package List: - openSUSE Backports SLE-15 (noarch): phpMyAdmin-4.8.3-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-15605.html https://bugzilla.suse.com/1105726

1 0

openSUSE-SU-2018:2521-2: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2521-2 Rating: moderate References: #1105598 Cross-References: CVE-2018-3780 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nextcloud to version 13.0.5 fixes the following issues: Security issues fixed: - CVE-2018-3780: Fixed a missing sanitization of search results for an autocomplete field that could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users. (boo#1105598) Other bugs fixed: - Fix highlighting of the upload drop zone - Apply ldapUserFilter on members of group - Make the DELETION of groups match greedy on the groupID - Add parent index to share table - Log full exception in cron instead of only the message - Properly lock the target file on dav upload when not using part files - LDAP backup server should not be queried when auth fails - Fix filenames in sharing integration tests - Lower log level for quota manipulation cases - Let user set avatar in nextcloud if LDAP provides invalid image data - Improved logging of smb connection errors - Allow admin to disable fetching of avatars as well as a specific attribute - Allow to disable encryption - Update message shown when unsharing a file - Fixed English grammatical error on Settings page. - Request a valid property for DAV opendir - Allow updating the token on session regeneration - Prevent lock values from going negative with memcache backend - Correctly handle users with numeric user ids - Correctly parse the subject parameters for link (un)shares of calendars - Fix "parsing" of email-addresses in comments and chat messages - Sanitize parameters in createSessionToken() while logging - Also retry rename operation on InvalidArgumentException - Improve url detection in comments - Only bind to ldap if configuration for the first server is set - Use download manager from PDF.js to download the file - Fix trying to load removed scripts - Only pull for new messages if the session is allowed to be kept alive - Always push object data - Add prioritization for Talk Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-936=1 Package List: - openSUSE Backports SLE-15 (noarch): nextcloud-13.0.5-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-3780.html https://bugzilla.suse.com/1105598

1 0

openSUSE-RU-2018:2490-2: moderate: Recommended update for python-websocket-client
by maintenance＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Recommended Update: Recommended update for python-websocket-client ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2490-2 Rating: moderate References: #1076519 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-websocket-client fixes the following issues: - The library did not contain a CA bundle and the system CAs had to be manually specified. Make it use the systems ca bundle file by default (boo#1076519) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-916=1 Package List: - openSUSE Backports SLE-15 (noarch): python2-websocket-client-0.44.0-bp150.2.3.1 python3-websocket-client-0.44.0-bp150.2.3.1 References: https://bugzilla.suse.com/1076519

1 0

openSUSE-SU-2018:2806-1: important: Security update for nemo-extensions
by opensuse-security＠opensuse.org 22 Sep '18

22 Sep '18

openSUSE Security Update: Security update for nemo-extensions ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2806-1 Rating: important References: #1084703 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for nemo-extensions fixes the following issues: The following security vulnerability was fixed: - Prevent unprivileged users from adding other users to sambashare (boo#1084703) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2018-882=1 Package List: - openSUSE Backports SLE-15 (x86_64): nemo-extension-dropbox-3.6.0-bp150.2.3.1 nemo-extension-fileroller-3.6.0-bp150.2.3.1 nemo-extension-gtkhash-3.6.0-bp150.2.3.1 nemo-extension-image-converter-3.6.0-bp150.2.3.1 nemo-extension-preview-3.6.0-bp150.2.3.1 nemo-extension-repairer-3.6.0-bp150.2.3.1 nemo-extension-seahorse-3.6.0-bp150.2.3.1 nemo-extension-share-3.6.0-bp150.2.3.1 python-nemo-3.6.0-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): nemo-extension-audio-tab-3.6.0-bp150.2.3.1 nemo-extension-compare-3.6.0-bp150.2.3.1 nemo-extension-emblems-3.6.0-bp150.2.3.1 nemo-extension-pastebin-3.6.0-bp150.2.3.1 nemo-extension-rabbitvcs-3.6.0-bp150.2.3.1 nemo-extension-terminal-3.6.0-bp150.2.3.1 References: https://bugzilla.suse.com/1084703

1 0