January 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:0043-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0043-1 Rating: important References: #1112142 #1112143 #1112144 #1112146 #1112147 #1112148 #1112152 #1112153 Cross-References: CVE-2018-13785 CVE-2018-16435 CVE-2018-3136 CVE-2018-3139 CVE-2018-3149 CVE-2018-3169 CVE-2018-3180 CVE-2018-3183 CVE-2018-3214 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk to version 8u191 fixes the following issues: Security issues fixed: - CVE-2018-3136: Manifest better support (bsc#1112142) - CVE-2018-3139: Better HTTP Redirection (bsc#1112143) - CVE-2018-3149: Enhance JNDI lookups (bsc#1112144) - CVE-2018-3169: Improve field accesses (bsc#1112146) - CVE-2018-3180: Improve TLS connections stability (bsc#1112147) - CVE-2018-3214: Better RIFF reading support (bsc#1112152) - CVE-2018-13785: Upgrade JDK 8u to libpng 1.6.35 (bsc#1112153) - CVE-2018-3183: Improve script engine support (bsc#1112148) - CVE-2018-16435: heap-based buffer overflow in SetData function in cmsIT8LoadFromFile This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-43=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-43=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_8_0-openjdk-1.8.0.191-30.1 java-1_8_0-openjdk-accessibility-1.8.0.191-30.1 java-1_8_0-openjdk-debuginfo-1.8.0.191-30.1 java-1_8_0-openjdk-debugsource-1.8.0.191-30.1 java-1_8_0-openjdk-demo-1.8.0.191-30.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.191-30.1 java-1_8_0-openjdk-devel-1.8.0.191-30.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.191-30.1 java-1_8_0-openjdk-headless-1.8.0.191-30.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.191-30.1 java-1_8_0-openjdk-src-1.8.0.191-30.1 - openSUSE Leap 42.3 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.191-30.1 - openSUSE Leap 15.0 (i586 x86_64): java-1_8_0-openjdk-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-accessibility-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-debuginfo-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-debugsource-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-demo-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-demo-debuginfo-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-devel-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-devel-debuginfo-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-headless-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-headless-debuginfo-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-src-1.8.0.191-lp150.2.9.2 - openSUSE Leap 15.0 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.191-lp150.2.9.2 References: https://www.suse.com/security/cve/CVE-2018-13785.html https://www.suse.com/security/cve/CVE-2018-16435.html https://www.suse.com/security/cve/CVE-2018-3136.html https://www.suse.com/security/cve/CVE-2018-3139.html https://www.suse.com/security/cve/CVE-2018-3149.html https://www.suse.com/security/cve/CVE-2018-3169.html https://www.suse.com/security/cve/CVE-2018-3180.html https://www.suse.com/security/cve/CVE-2018-3183.html https://www.suse.com/security/cve/CVE-2018-3214.html https://bugzilla.suse.com/1112142 https://bugzilla.suse.com/1112143 https://bugzilla.suse.com/1112144 https://bugzilla.suse.com/1112146 https://bugzilla.suse.com/1112147 https://bugzilla.suse.com/1112148 https://bugzilla.suse.com/1112152 https://bugzilla.suse.com/1112153

1 0

openSUSE-SU-2019:0019-1: moderate: Security update for discount
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for discount ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0019-1 Rating: moderate References: #1094809 #1098252 Cross-References: CVE-2018-11468 CVE-2018-12495 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for discount to version 2.2.4 fixes the following issues: Security issues fixed: - CVE-2018-11468: Fixed a heap-based buffer over-read in the __mkd_trim_line function from mkdio.c (boo#1094809) - CVE-2018-12495: Fixed a heap-based buffer over-read via a crafted file (boo#1098252) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-19=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-19=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-19=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): discount-2.2.4-7.3.1 discount-debugsource-2.2.4-7.3.1 libmarkdown-devel-2.2.4-7.3.1 libmarkdown2-2.2.4-7.3.1 libmarkdown2-debuginfo-2.2.4-7.3.1 - openSUSE Leap 15.0 (x86_64): discount-2.2.4-lp150.2.3.1 discount-debugsource-2.2.4-lp150.2.3.1 libmarkdown-devel-2.2.4-lp150.2.3.1 libmarkdown2-2.2.4-lp150.2.3.1 libmarkdown2-debuginfo-2.2.4-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): discount-2.2.4-bp150.3.3.1 libmarkdown-devel-2.2.4-bp150.3.3.1 libmarkdown2-2.2.4-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-11468.html https://www.suse.com/security/cve/CVE-2018-12495.html https://bugzilla.suse.com/1094809 https://bugzilla.suse.com/1098252

1 0

openSUSE-SU-2019:0021-1: important: Security update for libgit2
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for libgit2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0021-1 Rating: important References: #1110949 #1114729 Cross-References: CVE-2018-19456 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for libgit2 fixes the following issues: Security issues fixed: - CVE-2018-19456: Fixed a code execution by malicious .gitmodules file (bsc#1110949) - various string-to-integer and buffer handling fixes (bsc#1114729). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-21=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libgit2-24-0.24.1-10.6.1 libgit2-24-debuginfo-0.24.1-10.6.1 libgit2-debugsource-0.24.1-10.6.1 libgit2-devel-0.24.1-10.6.1 - openSUSE Leap 42.3 (x86_64): libgit2-24-32bit-0.24.1-10.6.1 libgit2-24-debuginfo-32bit-0.24.1-10.6.1 References: https://www.suse.com/security/cve/CVE-2018-19456.html https://bugzilla.suse.com/1110949 https://bugzilla.suse.com/1114729

1 0

openSUSE-SU-2019:0016-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 11 Jan '19

11 Jan '19

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0016-1 Rating: moderate References: #1120381 Cross-References: CVE-2018-20467 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issue: Security issue fixed: - CVE-2018-20467: Fixed infinite loop in coders/bmp.c (boo#1120381) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-16=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-123.1 GraphicsMagick-debuginfo-1.3.25-123.1 GraphicsMagick-debugsource-1.3.25-123.1 GraphicsMagick-devel-1.3.25-123.1 libGraphicsMagick++-Q16-12-1.3.25-123.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-123.1 libGraphicsMagick++-devel-1.3.25-123.1 libGraphicsMagick-Q16-3-1.3.25-123.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-123.1 libGraphicsMagick3-config-1.3.25-123.1 libGraphicsMagickWand-Q16-2-1.3.25-123.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-123.1 perl-GraphicsMagick-1.3.25-123.1 perl-GraphicsMagick-debuginfo-1.3.25-123.1 References: https://www.suse.com/security/cve/CVE-2018-20467.html https://bugzilla.suse.com/1120381

1 0

openSUSE-RU-2019:0014-1: moderate: Recommended update for mirror
by maintenance＠opensuse.org 11 Jan '19

11 Jan '19

openSUSE Recommended Update: Recommended update for mirror ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0014-1 Rating: moderate References: #1117110 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mirror provides the following fix: - Check if a directory must be removed. In case all the previous content of a directory is removed, but new content for the directory was downloaded, do not remove it. (bsc#1117110) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-14=1 Package List: - openSUSE Leap 15.0 (noarch): mirror-2.9-lp150.2.3.1 References: https://bugzilla.suse.com/1117110

1 0

openSUSE-RU-2019:0013-1: moderate: Recommended update for python-rtslib
by maintenance＠opensuse.org 11 Jan '19

11 Jan '19

openSUSE Recommended Update: Recommended update for python-rtslib ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0013-1 Rating: moderate References: #1113573 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-rtslib provides the following fix: - Add srpt_wwn WWN type handling. (bsc#1113573) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-13=1 Package List: - openSUSE Leap 42.3 (noarch): python-rtslib-2.2-19.6.1 References: https://bugzilla.suse.com/1113573

1 0

openSUSE-RU-2019:0011-1: moderate: Recommended update for OpenIPMI
by maintenance＠opensuse.org 11 Jan '19

11 Jan '19

openSUSE Recommended Update: Recommended update for OpenIPMI ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0011-1 Rating: moderate References: #1060799 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for OpenIPMI provides the following fix: - On aarch64 hardware, the IPMI hardware was detected but an incorrect driver was loaded ("ipmi_si.ko" rather than the correct "ipmi_ssif.ko"). The fix adds a new entry to /etc/sysconfig/ipmi which defines the name of the driver to load. A utility (/usr/lib/openipmi-helper) then uses this name to load the correct driveri. (bsc#1060799) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-11=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): OpenIPMI-2.0.21-14.1 OpenIPMI-debuginfo-2.0.21-14.1 OpenIPMI-debugsource-2.0.21-14.1 OpenIPMI-devel-2.0.21-14.1 OpenIPMI-python-2.0.21-14.1 OpenIPMI-python-debuginfo-2.0.21-14.1 References: https://bugzilla.suse.com/1060799

1 0

openSUSE-RU-2019:0012-1: moderate: Recommended update for mirror
by maintenance＠opensuse.org 11 Jan '19

11 Jan '19

openSUSE Recommended Update: Recommended update for mirror ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0012-1 Rating: moderate References: #1117110 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mirror provides the following fix: - Check if a directory must be removed. In case all the previous content of a directory is removed, but new content for the directory was downloaded, do not remove it. (bsc#1117110) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-12=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): mirror-2.9-914.3.1 References: https://bugzilla.suse.com/1117110

1 0

openSUSE-SU-2019:0010-1: moderate: Security update for polkit
by opensuse-security＠opensuse.org 10 Jan '19

10 Jan '19

openSUSE Security Update: Security update for polkit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0010-1 Rating: moderate References: #1118277 Cross-References: CVE-2018-19788 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for polkit fixes the following issues: Security issue fixed: - CVE-2018-19788: Fixed handling of UIDs over MAX_UINT (bsc#1118277) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-10=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libpolkit0-0.114-lp150.2.6.1 libpolkit0-debuginfo-0.114-lp150.2.6.1 polkit-0.114-lp150.2.6.1 polkit-debuginfo-0.114-lp150.2.6.1 polkit-debugsource-0.114-lp150.2.6.1 polkit-devel-0.114-lp150.2.6.1 polkit-devel-debuginfo-0.114-lp150.2.6.1 typelib-1_0-Polkit-1_0-0.114-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libpolkit0-32bit-0.114-lp150.2.6.1 libpolkit0-32bit-debuginfo-0.114-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): polkit-doc-0.114-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-19788.html https://bugzilla.suse.com/1118277

1 0

openSUSE-SU-2019:0008-1: moderate: Security update for libraw
by opensuse-security＠opensuse.org 10 Jan '19

10 Jan '19

openSUSE Security Update: Security update for libraw ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0008-1 Rating: moderate References: #1097975 #1103200 #1103206 Cross-References: CVE-2018-5804 CVE-2018-5813 CVE-2018-5815 CVE-2018-5816 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libraw fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-5813: Fixed an error within the "parse_minolta()" function (dcraw/dcraw.c) that could be exploited to trigger an infinite loop via a specially crafted file. This could be exploited to cause a DoS.(boo#1103200). - CVE-2018-5815: Fixed an integer overflow in the internal/dcraw_common.cpp:parse_qt() function, that could be exploited to cause an infinite loop via a specially crafted Apple QuickTime file. (boo#1103206) - CVE-2018-5804,CVE-2018-5816: Fixed a type confusion error in the identify function (bsc#1097975) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-8=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libraw-debuginfo-0.18.9-lp150.2.3.1 libraw-debugsource-0.18.9-lp150.2.3.1 libraw-devel-0.18.9-lp150.2.3.1 libraw-devel-static-0.18.9-lp150.2.3.1 libraw-tools-0.18.9-lp150.2.3.1 libraw-tools-debuginfo-0.18.9-lp150.2.3.1 libraw16-0.18.9-lp150.2.3.1 libraw16-debuginfo-0.18.9-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-5804.html https://www.suse.com/security/cve/CVE-2018-5813.html https://www.suse.com/security/cve/CVE-2018-5815.html https://www.suse.com/security/cve/CVE-2018-5816.html https://bugzilla.suse.com/1097975 https://bugzilla.suse.com/1103200 https://bugzilla.suse.com/1103206

1 0