January 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2019:0031-1: moderate: Recommended update for rollback-helper
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for rollback-helper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0031-1 Rating: moderate References: #1088552 #1108618 #1113048 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for rollback-helper fixes the following issues: - Run before any other services calling zypper (bsc#1113048) - Retry network connection if it doesn't work yet (bsc#1108618) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-31=1 Package List: - openSUSE Leap 42.3 (noarch): rollback-helper-1.0+git20181112.65db4d0-3.6.1 References: https://bugzilla.suse.com/1088552 https://bugzilla.suse.com/1108618 https://bugzilla.suse.com/1113048

1 0

openSUSE-SU-2019:0045-1: important: Security update for LibVNCServer
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for LibVNCServer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0045-1 Rating: important References: #1120114 #1120115 #1120116 #1120117 #1120118 #1120119 #1120120 #1120121 #1120122 Cross-References: CVE-2018-15126 CVE-2018-15127 CVE-2018-20019 CVE-2018-20020 CVE-2018-20021 CVE-2018-20022 CVE-2018-20023 CVE-2018-20024 CVE-2018-6307 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for LibVNCServer fixes the following issues: Security issues fixed: - CVE-2018-15126: Fixed use-after-free in file transfer extension (bsc#1120114) - CVE-2018-6307: Fixed use-after-free in file transfer extension server code (bsc#1120115) - CVE-2018-20020: Fixed heap out-of-bound write inside structure in VNC client code (bsc#1120116) - CVE-2018-15127: Fixed heap out-of-bounds write in rfbserver.c (bsc#1120117) - CVE-2018-20019: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1120118) - CVE-2018-20023: Fixed information disclosure through improper initialization in VNC Repeater client code (bsc#1120119) - CVE-2018-20022: Fixed information disclosure through improper initialization in VNC client code (bsc#1120120) - CVE-2018-20024: Fixed NULL pointer dereference in VNC client code (bsc#1120121) - CVE-2018-20021: Fixed infinite loop in VNC client code (bsc#1120122) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-45=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): LibVNCServer-debugsource-0.9.9-16.6.1 LibVNCServer-devel-0.9.9-16.6.1 libvncclient0-0.9.9-16.6.1 libvncclient0-debuginfo-0.9.9-16.6.1 libvncserver0-0.9.9-16.6.1 libvncserver0-debuginfo-0.9.9-16.6.1 linuxvnc-0.9.9-16.6.1 linuxvnc-debuginfo-0.9.9-16.6.1 References: https://www.suse.com/security/cve/CVE-2018-15126.html https://www.suse.com/security/cve/CVE-2018-15127.html https://www.suse.com/security/cve/CVE-2018-20019.html https://www.suse.com/security/cve/CVE-2018-20020.html https://www.suse.com/security/cve/CVE-2018-20021.html https://www.suse.com/security/cve/CVE-2018-20022.html https://www.suse.com/security/cve/CVE-2018-20023.html https://www.suse.com/security/cve/CVE-2018-20024.html https://www.suse.com/security/cve/CVE-2018-6307.html https://bugzilla.suse.com/1120114 https://bugzilla.suse.com/1120115 https://bugzilla.suse.com/1120116 https://bugzilla.suse.com/1120117 https://bugzilla.suse.com/1120118 https://bugzilla.suse.com/1120119 https://bugzilla.suse.com/1120120 https://bugzilla.suse.com/1120121 https://bugzilla.suse.com/1120122

1 0

openSUSE-OU-2019:0034-1: Optional update to add brotli
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Optional Update: Optional update to add brotli ______________________________________________________________________________ Announcement ID: openSUSE-OU-2019:0034-1 Rating: low References: #1106391 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update supplies the brotli compressor. (FATE#326659) It is a requirement for an upcoming webkit2gtk3 update. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-34=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): brotli-1.0.2-2.1 brotli-debuginfo-1.0.2-2.1 brotli-debugsource-1.0.2-2.1 libbrotli-devel-1.0.2-2.1 libbrotlicommon1-1.0.2-2.1 libbrotlicommon1-debuginfo-1.0.2-2.1 libbrotlidec1-1.0.2-2.1 libbrotlidec1-debuginfo-1.0.2-2.1 libbrotlienc1-1.0.2-2.1 libbrotlienc1-debuginfo-1.0.2-2.1 References: https://bugzilla.suse.com/1106391

1 0

openSUSE-SU-2019:0044-1: important: Security update for haproxy
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for haproxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0044-1 Rating: important References: #1119368 #1119419 Cross-References: CVE-2018-20102 CVE-2018-20103 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for haproxy to version 1.8.15 fixes the following issues: Security issues fixed: - CVE-2018-20102: Fixed an out-of-bounds read in dns_validate_dns_response(), which allowed for memory disclosure (bsc#1119368) - CVE-2018-20103: Fixed an infinite recursion via crafted packet allows stack exhaustion and denial of service (bsc#1119419) Other notable bug fixes: - Fix off-by-one write in dns_validate_dns_response() - Fix out-of-bounds read via signedness error in dns_validate_dns_response() - Prevent out-of-bounds read in dns_validate_dns_response() - Prevent out-of-bounds read in dns_read_name() - Prevent stack-exhaustion via recursion loop in dns_read_name For a full list of changes, please refer to: https://www.haproxy.org/download/1.8/src/CHANGELOG This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-44=1 Package List: - openSUSE Leap 15.0 (x86_64): haproxy-1.8.15~git0.6b6a350a-lp150.2.6.1 haproxy-debuginfo-1.8.15~git0.6b6a350a-lp150.2.6.1 haproxy-debugsource-1.8.15~git0.6b6a350a-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-20102.html https://www.suse.com/security/cve/CVE-2018-20103.html https://bugzilla.suse.com/1119368 https://bugzilla.suse.com/1119419

1 0

openSUSE-SU-2019:0020-1: moderate: Security update for gpg2
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for gpg2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0020-1 Rating: moderate References: #1120346 Cross-References: CVE-2018-1000858 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gpg2 fixes the following issue: Security issue fixed: - CVE-2018-1000858: Fixed a Cross Site Request Forgery(CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF (bsc#1120346). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-20=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): gpg2-2.2.5-lp150.3.6.1 gpg2-debuginfo-2.2.5-lp150.3.6.1 gpg2-debugsource-2.2.5-lp150.3.6.1 - openSUSE Leap 15.0 (noarch): gpg2-lang-2.2.5-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-1000858.html https://bugzilla.suse.com/1120346

1 0

openSUSE-RU-2019:0025-1: moderate: Recommended update for gdb
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for gdb ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0025-1 Rating: moderate References: #1109013 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gdb provides the following fix: - Fix a crash when reading core. (bsc#1109013) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-25=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gdb-8.2-10.1 gdb-debuginfo-8.2-10.1 gdb-debugsource-8.2-10.1 gdb-testresults-8.2-10.1 gdbserver-8.2-10.1 gdbserver-debuginfo-8.2-10.1 References: https://bugzilla.suse.com/1109013

1 0

openSUSE-RU-2019:0038-1: moderate: Recommended update for osinfo-db
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for osinfo-db ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0038-1 Rating: moderate References: #1086715 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for osinfo-db fixes the following issues: - Add correct release date for SLE12-SP4. - Update database to versions 20181116, 20181011, 20180920, 20180903. - Add support for sle15sp1. (bsc#1086715) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-38=1 Package List: - openSUSE Leap 15.0 (noarch): osinfo-db-20181116-lp150.2.9.1 References: https://bugzilla.suse.com/1086715

1 0

openSUSE-RU-2019:0036-1: moderate: Recommended update for gdm
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for gdm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0036-1 Rating: moderate References: #1112834 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gdm fixes the following issues: - Ignore duplicate desktop file with same "Name" value, including symlinks of desktop files. (bsc#1112834) - Drop the hardcoded "default.desktop" as LightDM and SDDM use symlinks as aliases. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-36=1 Package List: - openSUSE Leap 15.0 (noarch): gdm-branding-upstream-3.26.2.1-lp150.11.6.1 gdm-lang-3.26.2.1-lp150.11.6.1 gdmflexiserver-3.26.2.1-lp150.11.6.1 - openSUSE Leap 15.0 (x86_64): gdm-3.26.2.1-lp150.11.6.1 gdm-debuginfo-3.26.2.1-lp150.11.6.1 gdm-debugsource-3.26.2.1-lp150.11.6.1 gdm-devel-3.26.2.1-lp150.11.6.1 libgdm1-3.26.2.1-lp150.11.6.1 libgdm1-debuginfo-3.26.2.1-lp150.11.6.1 typelib-1_0-Gdm-1_0-3.26.2.1-lp150.11.6.1 References: https://bugzilla.suse.com/1112834

1 0

openSUSE-RU-2019:0033-1: moderate: Recommended update for apparmor
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for apparmor ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0033-1 Rating: moderate References: #1111345 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for apparmor fixes the following issues: - Update the last dnsmasq fix for logfiles when running under apparmor (bsc#1111345) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-33=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): apache2-mod_apparmor-2.12-lp150.6.6.1 apache2-mod_apparmor-debuginfo-2.12-lp150.6.6.1 apparmor-debugsource-2.12-lp150.6.6.1 apparmor-parser-2.12-lp150.6.6.1 apparmor-parser-debuginfo-2.12-lp150.6.6.1 libapparmor-debugsource-2.12-lp150.6.6.1 libapparmor-devel-2.12-lp150.6.6.1 libapparmor1-2.12-lp150.6.6.1 libapparmor1-debuginfo-2.12-lp150.6.6.1 pam_apparmor-2.12-lp150.6.6.1 pam_apparmor-debuginfo-2.12-lp150.6.6.1 perl-apparmor-2.12-lp150.6.6.1 perl-apparmor-debuginfo-2.12-lp150.6.6.1 python3-apparmor-2.12-lp150.6.6.1 python3-apparmor-debuginfo-2.12-lp150.6.6.1 ruby-apparmor-2.12-lp150.6.6.1 ruby-apparmor-debuginfo-2.12-lp150.6.6.1 - openSUSE Leap 15.0 (noarch): apparmor-abstractions-2.12-lp150.6.6.1 apparmor-docs-2.12-lp150.6.6.1 apparmor-parser-lang-2.12-lp150.6.6.1 apparmor-profiles-2.12-lp150.6.6.1 apparmor-utils-2.12-lp150.6.6.1 apparmor-utils-lang-2.12-lp150.6.6.1 - openSUSE Leap 15.0 (x86_64): libapparmor1-32bit-2.12-lp150.6.6.1 libapparmor1-32bit-debuginfo-2.12-lp150.6.6.1 pam_apparmor-32bit-2.12-lp150.6.6.1 pam_apparmor-32bit-debuginfo-2.12-lp150.6.6.1 References: https://bugzilla.suse.com/1111345

1 0

openSUSE-RU-2019:0039-1: moderate: Recommended update for xfsprogs
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for xfsprogs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0039-1 Rating: moderate References: #1119063 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xfsprogs fixes the following issues: - Fix root inode's parent when it's bogus for sf directory (xfs repair). (bsc#1119063) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-39=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): xfsprogs-4.15.0-lp150.3.7.1 xfsprogs-debuginfo-4.15.0-lp150.3.7.1 xfsprogs-debugsource-4.15.0-lp150.3.7.1 xfsprogs-devel-4.15.0-lp150.3.7.1 References: https://bugzilla.suse.com/1119063

1 0