January 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:0061-1: Security update for libunwind
by opensuse-security＠opensuse.org 17 Jan '19

17 Jan '19

openSUSE Security Update: Security update for libunwind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0061-1 Rating: low References: #1122012 #936786 Cross-References: CVE-2015-3239 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for libunwind fixes one minor security issue and one bug. The following security issue was fixed: - CVE-2015-3239: off-by-one error that could be triggered when reading untrusted binaries (boo#936786) The following packaging bug was fixed: - boo#1122012: The 32 bit were not generated on Leap 42.3 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-61=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libunwind-1.1-15.3.1 libunwind-debuginfo-1.1-15.3.1 libunwind-debugsource-1.1-15.3.1 libunwind-devel-1.1-15.3.1 - openSUSE Leap 42.3 (x86_64): libunwind-32bit-1.1-15.3.1 libunwind-debuginfo-32bit-1.1-15.3.1 References: https://www.suse.com/security/cve/CVE-2015-3239.html https://bugzilla.suse.com/1122012 https://bugzilla.suse.com/936786

1 0

openSUSE-RU-2019:0056-1: moderate: Recommended update for mozilla-nss
by maintenance＠opensuse.org 17 Jan '19

17 Jan '19

openSUSE Recommended Update: Recommended update for mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0056-1 Rating: moderate References: #1090767 #1121045 #1121207 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for mozilla-nss fixes the following issues: - The hmac packages used in FIPS certification inadvertently removed in last update: re-added. (bsc#1121207) - Added "Suggest:" for libfreebl3 and libsoftokn3 respective -hmac packages to avoid dependency issues during updates (bsc#1090767, bsc#1121045) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-56=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libfreebl3-3.40.1-lp150.2.13.1 libfreebl3-debuginfo-3.40.1-lp150.2.13.1 libfreebl3-hmac-3.40.1-lp150.2.13.1 libsoftokn3-3.40.1-lp150.2.13.1 libsoftokn3-debuginfo-3.40.1-lp150.2.13.1 libsoftokn3-hmac-3.40.1-lp150.2.13.1 mozilla-nss-3.40.1-lp150.2.13.1 mozilla-nss-certs-3.40.1-lp150.2.13.1 mozilla-nss-certs-debuginfo-3.40.1-lp150.2.13.1 mozilla-nss-debuginfo-3.40.1-lp150.2.13.1 mozilla-nss-debugsource-3.40.1-lp150.2.13.1 mozilla-nss-devel-3.40.1-lp150.2.13.1 mozilla-nss-sysinit-3.40.1-lp150.2.13.1 mozilla-nss-sysinit-debuginfo-3.40.1-lp150.2.13.1 mozilla-nss-tools-3.40.1-lp150.2.13.1 mozilla-nss-tools-debuginfo-3.40.1-lp150.2.13.1 - openSUSE Leap 15.0 (x86_64): libfreebl3-32bit-3.40.1-lp150.2.13.1 libfreebl3-32bit-debuginfo-3.40.1-lp150.2.13.1 libsoftokn3-32bit-3.40.1-lp150.2.13.1 libsoftokn3-32bit-debuginfo-3.40.1-lp150.2.13.1 mozilla-nss-32bit-3.40.1-lp150.2.13.1 mozilla-nss-32bit-debuginfo-3.40.1-lp150.2.13.1 mozilla-nss-certs-32bit-3.40.1-lp150.2.13.1 mozilla-nss-certs-32bit-debuginfo-3.40.1-lp150.2.13.1 mozilla-nss-sysinit-32bit-3.40.1-lp150.2.13.1 mozilla-nss-sysinit-32bit-debuginfo-3.40.1-lp150.2.13.1 References: https://bugzilla.suse.com/1090767 https://bugzilla.suse.com/1121045 https://bugzilla.suse.com/1121207

1 0

openSUSE-RU-2019:0055-1: moderate: Recommended update for python3-susepubliccloudinfo
by maintenance＠opensuse.org 17 Jan '19

17 Jan '19

openSUSE Recommended Update: Recommended update for python3-susepubliccloudinfo ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0055-1 Rating: moderate References: #1121150 #1121151 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for python3-susepubliccloudinfo fixes the following issues: Update to version 1.1.0 (bsc#1121151, bsc#1121150) + Support new inactive state + Remove awscvsgen and associated subpackage This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-55=1 Package List: - openSUSE Leap 15.0 (noarch): python3-susepubliccloudinfo-1.1.0-lp150.2.6.1 References: https://bugzilla.suse.com/1121150 https://bugzilla.suse.com/1121151

1 0

openSUSE-SU-2019:0053-1: important: Security update for LibVNCServer
by opensuse-security＠opensuse.org 17 Jan '19

17 Jan '19

openSUSE Security Update: Security update for LibVNCServer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0053-1 Rating: important References: #1120114 #1120115 #1120116 #1120117 #1120118 #1120119 #1120120 #1120121 #1120122 Cross-References: CVE-2018-15126 CVE-2018-15127 CVE-2018-20019 CVE-2018-20020 CVE-2018-20021 CVE-2018-20022 CVE-2018-20023 CVE-2018-20024 CVE-2018-6307 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for LibVNCServer fixes the following issues: Security issues fixed: - CVE-2018-15126: Fixed use-after-free in file transfer extension (bsc#1120114) - CVE-2018-6307: Fixed use-after-free in file transfer extension server code (bsc#1120115) - CVE-2018-20020: Fixed heap out-of-bound write inside structure in VNC client code (bsc#1120116) - CVE-2018-15127: Fixed heap out-of-bounds write in rfbserver.c (bsc#1120117) - CVE-2018-20019: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1120118) - CVE-2018-20023: Fixed information disclosure through improper initialization in VNC Repeater client code (bsc#1120119) - CVE-2018-20022: Fixed information disclosure through improper initialization in VNC client code (bsc#1120120) - CVE-2018-20024: Fixed NULL pointer dereference in VNC client code (bsc#1120121) - CVE-2018-20021: Fixed infinite loop in VNC client code (bsc#1120122) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-53=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): LibVNCServer-debugsource-0.9.10-lp150.3.3.1 LibVNCServer-devel-0.9.10-lp150.3.3.1 libvncclient0-0.9.10-lp150.3.3.1 libvncclient0-debuginfo-0.9.10-lp150.3.3.1 libvncserver0-0.9.10-lp150.3.3.1 libvncserver0-debuginfo-0.9.10-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-15126.html https://www.suse.com/security/cve/CVE-2018-15127.html https://www.suse.com/security/cve/CVE-2018-20019.html https://www.suse.com/security/cve/CVE-2018-20020.html https://www.suse.com/security/cve/CVE-2018-20021.html https://www.suse.com/security/cve/CVE-2018-20022.html https://www.suse.com/security/cve/CVE-2018-20023.html https://www.suse.com/security/cve/CVE-2018-20024.html https://www.suse.com/security/cve/CVE-2018-6307.html https://bugzilla.suse.com/1120114 https://bugzilla.suse.com/1120115 https://bugzilla.suse.com/1120116 https://bugzilla.suse.com/1120117 https://bugzilla.suse.com/1120118 https://bugzilla.suse.com/1120119 https://bugzilla.suse.com/1120120 https://bugzilla.suse.com/1120121 https://bugzilla.suse.com/1120122

1 0

openSUSE-SU-2019:0057-1: important: Security update for wget
by opensuse-security＠opensuse.org 17 Jan '19

17 Jan '19

openSUSE Security Update: Security update for wget ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0057-1 Rating: important References: #1120382 Cross-References: CVE-2018-20483 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for wget fixes the following issues: Security issue fixed: - CVE-2018-20483: Fixed an information disclosure through file metadata (bsc#1120382) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-57=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): wget-1.19.5-lp150.2.3.1 wget-debuginfo-1.19.5-lp150.2.3.1 wget-debugsource-1.19.5-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-20483.html https://bugzilla.suse.com/1120382

1 0

openSUSE-SU-2019:0063-1: important: Security update for krb5
by opensuse-security＠opensuse.org 17 Jan '19

17 Jan '19

openSUSE Security Update: Security update for krb5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0063-1 Rating: important References: #1120489 Cross-References: CVE-2018-20217 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for krb5 fixes the following issues: Security issue fixed: - CVE-2018-20217: Fixed an assertion issue with older encryption types (bsc#1120489) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-63=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): krb5-1.15.2-lp150.5.3.1 krb5-client-1.15.2-lp150.5.3.1 krb5-client-debuginfo-1.15.2-lp150.5.3.1 krb5-debuginfo-1.15.2-lp150.5.3.1 krb5-debugsource-1.15.2-lp150.5.3.1 krb5-devel-1.15.2-lp150.5.3.1 krb5-mini-1.15.2-lp150.5.3.1 krb5-mini-debuginfo-1.15.2-lp150.5.3.1 krb5-mini-debugsource-1.15.2-lp150.5.3.1 krb5-mini-devel-1.15.2-lp150.5.3.1 krb5-plugin-kdb-ldap-1.15.2-lp150.5.3.1 krb5-plugin-kdb-ldap-debuginfo-1.15.2-lp150.5.3.1 krb5-plugin-preauth-otp-1.15.2-lp150.5.3.1 krb5-plugin-preauth-otp-debuginfo-1.15.2-lp150.5.3.1 krb5-plugin-preauth-pkinit-1.15.2-lp150.5.3.1 krb5-plugin-preauth-pkinit-debuginfo-1.15.2-lp150.5.3.1 krb5-server-1.15.2-lp150.5.3.1 krb5-server-debuginfo-1.15.2-lp150.5.3.1 - openSUSE Leap 15.0 (x86_64): krb5-32bit-1.15.2-lp150.5.3.1 krb5-32bit-debuginfo-1.15.2-lp150.5.3.1 krb5-devel-32bit-1.15.2-lp150.5.3.1 References: https://www.suse.com/security/cve/CVE-2018-20217.html https://bugzilla.suse.com/1120489

1 0

openSUSE-SU-2019:0052-1: important: Security update for mutt
by opensuse-security＠opensuse.org 17 Jan '19

17 Jan '19

openSUSE Security Update: Security update for mutt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0052-1 Rating: important References: #1061343 #1094717 #1101428 #1101566 #1101567 #1101568 #1101569 #1101570 #1101571 #1101573 #1101576 #1101577 #1101578 #1101581 #1101582 #1101583 #1101588 #1101589 #1120935 #980830 #982129 #986534 Cross-References: CVE-2014-9116 CVE-2018-14349 CVE-2018-14350 CVE-2018-14351 CVE-2018-14352 CVE-2018-14353 CVE-2018-14354 CVE-2018-14355 CVE-2018-14356 CVE-2018-14357 CVE-2018-14358 CVE-2018-14359 CVE-2018-14360 CVE-2018-14361 CVE-2018-14362 CVE-2018-14363 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 16 vulnerabilities and has 6 fixes is now available. Description: This update for mutt fixes the following issues: Security issues fixed: - bsc#1101428: Mutt 1.10.1 security release update. - CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size (bsc#1101583). - CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581). - CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567). - CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578). - CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582). - CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576). - CVE-2018-14355: Fix imap/util.c that mishandles ".." directory traversal in a mailbox name (bsc#1101577). - CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589). - CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588). - CVE-2018-14363: Fix newsrc.c that does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames (bsc#1101566). - CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570). - CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571). - CVE-2018-14360: Fix nntp_add_group in newsrc.c that has a stack-based buffer overflow because of incorrect sscanf usage (bsc#1101569). - CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573). - CVE-2018-14361: Fix that nntp.c proceeds even if memory allocation fails for messages data (bsc#1101568). Bug fixes: - mutt reports as neomutt and incorrect version (bsc#1094717) - No sidebar available in mutt 1.6.1 from Tumbleweed snapshot 20160517 (bsc#980830) - mutt-1.6.1 unusable when built with --enable-sidebar (bsc#982129) - (neo)mutt displaying times in Zulu time (bsc#1061343) - mutt unconditionally segfaults when displaying a message (bsc#986534) - For openSUSE Leap 42.3, retain split of -lang and -doc (boo#1120935) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-52=1 Package List: - openSUSE Leap 42.3 (noarch): mutt-doc-1.10.1-2.5.1 mutt-lang-1.10.1-2.5.1 - openSUSE Leap 42.3 (x86_64): mutt-1.10.1-2.5.1 mutt-debuginfo-1.10.1-2.5.1 mutt-debugsource-1.10.1-2.5.1 References: https://www.suse.com/security/cve/CVE-2014-9116.html https://www.suse.com/security/cve/CVE-2018-14349.html https://www.suse.com/security/cve/CVE-2018-14350.html https://www.suse.com/security/cve/CVE-2018-14351.html https://www.suse.com/security/cve/CVE-2018-14352.html https://www.suse.com/security/cve/CVE-2018-14353.html https://www.suse.com/security/cve/CVE-2018-14354.html https://www.suse.com/security/cve/CVE-2018-14355.html https://www.suse.com/security/cve/CVE-2018-14356.html https://www.suse.com/security/cve/CVE-2018-14357.html https://www.suse.com/security/cve/CVE-2018-14358.html https://www.suse.com/security/cve/CVE-2018-14359.html https://www.suse.com/security/cve/CVE-2018-14360.html https://www.suse.com/security/cve/CVE-2018-14361.html https://www.suse.com/security/cve/CVE-2018-14362.html https://www.suse.com/security/cve/CVE-2018-14363.html https://bugzilla.suse.com/1061343 https://bugzilla.suse.com/1094717 https://bugzilla.suse.com/1101428 https://bugzilla.suse.com/1101566 https://bugzilla.suse.com/1101567 https://bugzilla.suse.com/1101568 https://bugzilla.suse.com/1101569 https://bugzilla.suse.com/1101570 https://bugzilla.suse.com/1101571 https://bugzilla.suse.com/1101573 https://bugzilla.suse.com/1101576 https://bugzilla.suse.com/1101577 https://bugzilla.suse.com/1101578 https://bugzilla.suse.com/1101581 https://bugzilla.suse.com/1101582 https://bugzilla.suse.com/1101583 https://bugzilla.suse.com/1101588 https://bugzilla.suse.com/1101589 https://bugzilla.suse.com/1120935 https://bugzilla.suse.com/980830 https://bugzilla.suse.com/982129 https://bugzilla.suse.com/986534

1 0

openSUSE-SU-2019:0048-1: important: Security update for irssi
by opensuse-security＠opensuse.org 13 Jan '19

13 Jan '19

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0048-1 Rating: important References: #1121396 Cross-References: CVE-2019-5882 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for irssi fixes the following issues: - CVE-2019-5882: Use after free when hidden lines were expired from the scroll buffer (boo#1121396) This update to the 1.1.2 version also fixes a number of stability issues and bugs. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-48=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-48=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-48=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-48=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): irssi-1.1.2-29.1 irssi-debuginfo-1.1.2-29.1 irssi-debugsource-1.1.2-29.1 irssi-devel-1.1.2-29.1 - openSUSE Leap 15.0 (x86_64): irssi-1.1.2-lp150.2.4.1 irssi-debuginfo-1.1.2-lp150.2.4.1 irssi-debugsource-1.1.2-lp150.2.4.1 irssi-devel-1.1.2-lp150.2.4.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): irssi-1.1.2-bp150.3.4.1 irssi-devel-1.1.2-bp150.3.4.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): irssi-1.1.2-47.1 irssi-devel-1.1.2-47.1 References: https://www.suse.com/security/cve/CVE-2019-5882.html https://bugzilla.suse.com/1121396

1 0

openSUSE-RU-2019:0046-1: moderate: Recommended update for suse-build-key
by maintenance＠opensuse.org 13 Jan '19

13 Jan '19

openSUSE Recommended Update: Recommended update for suse-build-key ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0046-1 Rating: moderate References: #1044232 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for suse-build-key fixes the following issues: - The SUSE PTF signing keys were marked as documentation and were thus excluded from appliance builds (bsc#1044232) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-46=1 Package List: - openSUSE Leap 15.0 (noarch): suse-build-key-12.0-lp150.3.3.1 References: https://bugzilla.suse.com/1044232

1 0

openSUSE-RU-2019:0049-1: moderate: Recommended update for mutter
by maintenance＠opensuse.org 13 Jan '19

13 Jan '19

openSUSE Recommended Update: Recommended update for mutter ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0049-1 Rating: moderate References: #1017412 #1024748 #1045440 #1052058 #1093541 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for mutter provides the following fix: - Memory leak in gnome-shell (bsc#1093541) - Drop stray assert to avoid crash when static workspace number is decreased. (bsc#1045440) - Add RGB16_565 format to support 16-bit color depth sessions. (fate#323412, bsc#1024748) - Fix memory leak in meta_prop_get_values(). (bsc#1017412) - Implement _NET_RESTACK_WINDOW and respect the sibling field of XConfigureRequestEvent. This way X11 window stack operations work as expected. (bsc#1052058) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-49=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libmutter0-3.20.3-6.3.1 libmutter0-debuginfo-3.20.3-6.3.1 mutter-3.20.3-6.3.1 mutter-data-3.20.3-6.3.1 mutter-debuginfo-3.20.3-6.3.1 mutter-debugsource-3.20.3-6.3.1 mutter-devel-3.20.3-6.3.1 typelib-1_0-Meta-3_0-3.20.3-6.3.1 - openSUSE Leap 42.3 (noarch): mutter-lang-3.20.3-6.3.1 References: https://bugzilla.suse.com/1017412 https://bugzilla.suse.com/1024748 https://bugzilla.suse.com/1045440 https://bugzilla.suse.com/1052058 https://bugzilla.suse.com/1093541

1 0