January 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:0061-1: Security update for libunwind
by opensuse-security＠opensuse.org 17 Jan '19

17 Jan '19

openSUSE Security Update: Security update for libunwind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0061-1 Rating: low References: #1122012 #936786 Cross-References: CVE-2015-3239 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for libunwind fixes one minor security issue and one bug. The following security issue was fixed: - CVE-2015-3239: off-by-one error that could be triggered when reading untrusted binaries (boo#936786) The following packaging bug was fixed: - boo#1122012: The 32 bit were not generated on Leap 42.3 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-61=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libunwind-1.1-15.3.1 libunwind-debuginfo-1.1-15.3.1 libunwind-debugsource-1.1-15.3.1 libunwind-devel-1.1-15.3.1 - openSUSE Leap 42.3 (x86_64): libunwind-32bit-1.1-15.3.1 libunwind-debuginfo-32bit-1.1-15.3.1 References: https://www.suse.com/security/cve/CVE-2015-3239.html https://bugzilla.suse.com/1122012 https://bugzilla.suse.com/936786

1 0

openSUSE-RU-2019:0056-1: moderate: Recommended update for mozilla-nss
by maintenance＠opensuse.org 17 Jan '19

17 Jan '19

openSUSE Recommended Update: Recommended update for mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0056-1 Rating: moderate References: #1090767 #1121045 #1121207 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for mozilla-nss fixes the following issues: - The hmac packages used in FIPS certification inadvertently removed in last update: re-added. (bsc#1121207) - Added "Suggest:" for libfreebl3 and libsoftokn3 respective -hmac packages to avoid dependency issues during updates (bsc#1090767, bsc#1121045) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-56=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libfreebl3-3.40.1-lp150.2.13.1 libfreebl3-debuginfo-3.40.1-lp150.2.13.1 libfreebl3-hmac-3.40.1-lp150.2.13.1 libsoftokn3-3.40.1-lp150.2.13.1 libsoftokn3-debuginfo-3.40.1-lp150.2.13.1 libsoftokn3-hmac-3.40.1-lp150.2.13.1 mozilla-nss-3.40.1-lp150.2.13.1 mozilla-nss-certs-3.40.1-lp150.2.13.1 mozilla-nss-certs-debuginfo-3.40.1-lp150.2.13.1 mozilla-nss-debuginfo-3.40.1-lp150.2.13.1 mozilla-nss-debugsource-3.40.1-lp150.2.13.1 mozilla-nss-devel-3.40.1-lp150.2.13.1 mozilla-nss-sysinit-3.40.1-lp150.2.13.1 mozilla-nss-sysinit-debuginfo-3.40.1-lp150.2.13.1 mozilla-nss-tools-3.40.1-lp150.2.13.1 mozilla-nss-tools-debuginfo-3.40.1-lp150.2.13.1 - openSUSE Leap 15.0 (x86_64): libfreebl3-32bit-3.40.1-lp150.2.13.1 libfreebl3-32bit-debuginfo-3.40.1-lp150.2.13.1 libsoftokn3-32bit-3.40.1-lp150.2.13.1 libsoftokn3-32bit-debuginfo-3.40.1-lp150.2.13.1 mozilla-nss-32bit-3.40.1-lp150.2.13.1 mozilla-nss-32bit-debuginfo-3.40.1-lp150.2.13.1 mozilla-nss-certs-32bit-3.40.1-lp150.2.13.1 mozilla-nss-certs-32bit-debuginfo-3.40.1-lp150.2.13.1 mozilla-nss-sysinit-32bit-3.40.1-lp150.2.13.1 mozilla-nss-sysinit-32bit-debuginfo-3.40.1-lp150.2.13.1 References: https://bugzilla.suse.com/1090767 https://bugzilla.suse.com/1121045 https://bugzilla.suse.com/1121207

1 0

openSUSE-RU-2019:0055-1: moderate: Recommended update for python3-susepubliccloudinfo
by maintenance＠opensuse.org 17 Jan '19

17 Jan '19

openSUSE Recommended Update: Recommended update for python3-susepubliccloudinfo ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0055-1 Rating: moderate References: #1121150 #1121151 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for python3-susepubliccloudinfo fixes the following issues: Update to version 1.1.0 (bsc#1121151, bsc#1121150) + Support new inactive state + Remove awscvsgen and associated subpackage This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-55=1 Package List: - openSUSE Leap 15.0 (noarch): python3-susepubliccloudinfo-1.1.0-lp150.2.6.1 References: https://bugzilla.suse.com/1121150 https://bugzilla.suse.com/1121151

1 0

openSUSE-SU-2019:0053-1: important: Security update for LibVNCServer
by opensuse-security＠opensuse.org 17 Jan '19

17 Jan '19

openSUSE Security Update: Security update for LibVNCServer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0053-1 Rating: important References: #1120114 #1120115 #1120116 #1120117 #1120118 #1120119 #1120120 #1120121 #1120122 Cross-References: CVE-2018-15126 CVE-2018-15127 CVE-2018-20019 CVE-2018-20020 CVE-2018-20021 CVE-2018-20022 CVE-2018-20023 CVE-2018-20024 CVE-2018-6307 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for LibVNCServer fixes the following issues: Security issues fixed: - CVE-2018-15126: Fixed use-after-free in file transfer extension (bsc#1120114) - CVE-2018-6307: Fixed use-after-free in file transfer extension server code (bsc#1120115) - CVE-2018-20020: Fixed heap out-of-bound write inside structure in VNC client code (bsc#1120116) - CVE-2018-15127: Fixed heap out-of-bounds write in rfbserver.c (bsc#1120117) - CVE-2018-20019: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1120118) - CVE-2018-20023: Fixed information disclosure through improper initialization in VNC Repeater client code (bsc#1120119) - CVE-2018-20022: Fixed information disclosure through improper initialization in VNC client code (bsc#1120120) - CVE-2018-20024: Fixed NULL pointer dereference in VNC client code (bsc#1120121) - CVE-2018-20021: Fixed infinite loop in VNC client code (bsc#1120122) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-53=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): LibVNCServer-debugsource-0.9.10-lp150.3.3.1 LibVNCServer-devel-0.9.10-lp150.3.3.1 libvncclient0-0.9.10-lp150.3.3.1 libvncclient0-debuginfo-0.9.10-lp150.3.3.1 libvncserver0-0.9.10-lp150.3.3.1 libvncserver0-debuginfo-0.9.10-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-15126.html https://www.suse.com/security/cve/CVE-2018-15127.html https://www.suse.com/security/cve/CVE-2018-20019.html https://www.suse.com/security/cve/CVE-2018-20020.html https://www.suse.com/security/cve/CVE-2018-20021.html https://www.suse.com/security/cve/CVE-2018-20022.html https://www.suse.com/security/cve/CVE-2018-20023.html https://www.suse.com/security/cve/CVE-2018-20024.html https://www.suse.com/security/cve/CVE-2018-6307.html https://bugzilla.suse.com/1120114 https://bugzilla.suse.com/1120115 https://bugzilla.suse.com/1120116 https://bugzilla.suse.com/1120117 https://bugzilla.suse.com/1120118 https://bugzilla.suse.com/1120119 https://bugzilla.suse.com/1120120 https://bugzilla.suse.com/1120121 https://bugzilla.suse.com/1120122

1 0

openSUSE-SU-2019:0057-1: important: Security update for wget
by opensuse-security＠opensuse.org 17 Jan '19

17 Jan '19

openSUSE Security Update: Security update for wget ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0057-1 Rating: important References: #1120382 Cross-References: CVE-2018-20483 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for wget fixes the following issues: Security issue fixed: - CVE-2018-20483: Fixed an information disclosure through file metadata (bsc#1120382) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-57=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): wget-1.19.5-lp150.2.3.1 wget-debuginfo-1.19.5-lp150.2.3.1 wget-debugsource-1.19.5-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-20483.html https://bugzilla.suse.com/1120382

1 0

openSUSE-SU-2019:0063-1: important: Security update for krb5
by opensuse-security＠opensuse.org 17 Jan '19

17 Jan '19

openSUSE Security Update: Security update for krb5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0063-1 Rating: important References: #1120489 Cross-References: CVE-2018-20217 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for krb5 fixes the following issues: Security issue fixed: - CVE-2018-20217: Fixed an assertion issue with older encryption types (bsc#1120489) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-63=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): krb5-1.15.2-lp150.5.3.1 krb5-client-1.15.2-lp150.5.3.1 krb5-client-debuginfo-1.15.2-lp150.5.3.1 krb5-debuginfo-1.15.2-lp150.5.3.1 krb5-debugsource-1.15.2-lp150.5.3.1 krb5-devel-1.15.2-lp150.5.3.1 krb5-mini-1.15.2-lp150.5.3.1 krb5-mini-debuginfo-1.15.2-lp150.5.3.1 krb5-mini-debugsource-1.15.2-lp150.5.3.1 krb5-mini-devel-1.15.2-lp150.5.3.1 krb5-plugin-kdb-ldap-1.15.2-lp150.5.3.1 krb5-plugin-kdb-ldap-debuginfo-1.15.2-lp150.5.3.1 krb5-plugin-preauth-otp-1.15.2-lp150.5.3.1 krb5-plugin-preauth-otp-debuginfo-1.15.2-lp150.5.3.1 krb5-plugin-preauth-pkinit-1.15.2-lp150.5.3.1 krb5-plugin-preauth-pkinit-debuginfo-1.15.2-lp150.5.3.1 krb5-server-1.15.2-lp150.5.3.1 krb5-server-debuginfo-1.15.2-lp150.5.3.1 - openSUSE Leap 15.0 (x86_64): krb5-32bit-1.15.2-lp150.5.3.1 krb5-32bit-debuginfo-1.15.2-lp150.5.3.1 krb5-devel-32bit-1.15.2-lp150.5.3.1 References: https://www.suse.com/security/cve/CVE-2018-20217.html https://bugzilla.suse.com/1120489

1 0

openSUSE-SU-2019:0052-1: important: Security update for mutt
by opensuse-security＠opensuse.org 17 Jan '19

17 Jan '19

openSUSE Security Update: Security update for mutt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0052-1 Rating: important References: #1061343 #1094717 #1101428 #1101566 #1101567 #1101568 #1101569 #1101570 #1101571 #1101573 #1101576 #1101577 #1101578 #1101581 #1101582 #1101583 #1101588 #1101589 #1120935 #980830 #982129 #986534 Cross-References: CVE-2014-9116 CVE-2018-14349 CVE-2018-14350 CVE-2018-14351 CVE-2018-14352 CVE-2018-14353 CVE-2018-14354 CVE-2018-14355 CVE-2018-14356 CVE-2018-14357 CVE-2018-14358 CVE-2018-14359 CVE-2018-14360 CVE-2018-14361 CVE-2018-14362 CVE-2018-14363 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 16 vulnerabilities and has 6 fixes is now available. Description: This update for mutt fixes the following issues: Security issues fixed: - bsc#1101428: Mutt 1.10.1 security release update. - CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size (bsc#1101583). - CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581). - CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567). - CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578). - CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582). - CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576). - CVE-2018-14355: Fix imap/util.c that mishandles ".." directory traversal in a mailbox name (bsc#1101577). - CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589). - CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588). - CVE-2018-14363: Fix newsrc.c that does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames (bsc#1101566). - CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570). - CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571). - CVE-2018-14360: Fix nntp_add_group in newsrc.c that has a stack-based buffer overflow because of incorrect sscanf usage (bsc#1101569). - CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573). - CVE-2018-14361: Fix that nntp.c proceeds even if memory allocation fails for messages data (bsc#1101568). Bug fixes: - mutt reports as neomutt and incorrect version (bsc#1094717) - No sidebar available in mutt 1.6.1 from Tumbleweed snapshot 20160517 (bsc#980830) - mutt-1.6.1 unusable when built with --enable-sidebar (bsc#982129) - (neo)mutt displaying times in Zulu time (bsc#1061343) - mutt unconditionally segfaults when displaying a message (bsc#986534) - For openSUSE Leap 42.3, retain split of -lang and -doc (boo#1120935) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-52=1 Package List: - openSUSE Leap 42.3 (noarch): mutt-doc-1.10.1-2.5.1 mutt-lang-1.10.1-2.5.1 - openSUSE Leap 42.3 (x86_64): mutt-1.10.1-2.5.1 mutt-debuginfo-1.10.1-2.5.1 mutt-debugsource-1.10.1-2.5.1 References: https://www.suse.com/security/cve/CVE-2014-9116.html https://www.suse.com/security/cve/CVE-2018-14349.html https://www.suse.com/security/cve/CVE-2018-14350.html https://www.suse.com/security/cve/CVE-2018-14351.html https://www.suse.com/security/cve/CVE-2018-14352.html https://www.suse.com/security/cve/CVE-2018-14353.html https://www.suse.com/security/cve/CVE-2018-14354.html https://www.suse.com/security/cve/CVE-2018-14355.html https://www.suse.com/security/cve/CVE-2018-14356.html https://www.suse.com/security/cve/CVE-2018-14357.html https://www.suse.com/security/cve/CVE-2018-14358.html https://www.suse.com/security/cve/CVE-2018-14359.html https://www.suse.com/security/cve/CVE-2018-14360.html https://www.suse.com/security/cve/CVE-2018-14361.html https://www.suse.com/security/cve/CVE-2018-14362.html https://www.suse.com/security/cve/CVE-2018-14363.html https://bugzilla.suse.com/1061343 https://bugzilla.suse.com/1094717 https://bugzilla.suse.com/1101428 https://bugzilla.suse.com/1101566 https://bugzilla.suse.com/1101567 https://bugzilla.suse.com/1101568 https://bugzilla.suse.com/1101569 https://bugzilla.suse.com/1101570 https://bugzilla.suse.com/1101571 https://bugzilla.suse.com/1101573 https://bugzilla.suse.com/1101576 https://bugzilla.suse.com/1101577 https://bugzilla.suse.com/1101578 https://bugzilla.suse.com/1101581 https://bugzilla.suse.com/1101582 https://bugzilla.suse.com/1101583 https://bugzilla.suse.com/1101588 https://bugzilla.suse.com/1101589 https://bugzilla.suse.com/1120935 https://bugzilla.suse.com/980830 https://bugzilla.suse.com/982129 https://bugzilla.suse.com/986534

1 0

openSUSE-SU-2019:0048-1: important: Security update for irssi
by opensuse-security＠opensuse.org 13 Jan '19

13 Jan '19

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0048-1 Rating: important References: #1121396 Cross-References: CVE-2019-5882 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for irssi fixes the following issues: - CVE-2019-5882: Use after free when hidden lines were expired from the scroll buffer (boo#1121396) This update to the 1.1.2 version also fixes a number of stability issues and bugs. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-48=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-48=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-48=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-48=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): irssi-1.1.2-29.1 irssi-debuginfo-1.1.2-29.1 irssi-debugsource-1.1.2-29.1 irssi-devel-1.1.2-29.1 - openSUSE Leap 15.0 (x86_64): irssi-1.1.2-lp150.2.4.1 irssi-debuginfo-1.1.2-lp150.2.4.1 irssi-debugsource-1.1.2-lp150.2.4.1 irssi-devel-1.1.2-lp150.2.4.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): irssi-1.1.2-bp150.3.4.1 irssi-devel-1.1.2-bp150.3.4.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): irssi-1.1.2-47.1 irssi-devel-1.1.2-47.1 References: https://www.suse.com/security/cve/CVE-2019-5882.html https://bugzilla.suse.com/1121396

1 0

openSUSE-RU-2019:0046-1: moderate: Recommended update for suse-build-key
by maintenance＠opensuse.org 13 Jan '19

13 Jan '19

openSUSE Recommended Update: Recommended update for suse-build-key ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0046-1 Rating: moderate References: #1044232 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for suse-build-key fixes the following issues: - The SUSE PTF signing keys were marked as documentation and were thus excluded from appliance builds (bsc#1044232) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-46=1 Package List: - openSUSE Leap 15.0 (noarch): suse-build-key-12.0-lp150.3.3.1 References: https://bugzilla.suse.com/1044232

1 0

openSUSE-RU-2019:0049-1: moderate: Recommended update for mutter
by maintenance＠opensuse.org 13 Jan '19

13 Jan '19

openSUSE Recommended Update: Recommended update for mutter ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0049-1 Rating: moderate References: #1017412 #1024748 #1045440 #1052058 #1093541 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for mutter provides the following fix: - Memory leak in gnome-shell (bsc#1093541) - Drop stray assert to avoid crash when static workspace number is decreased. (bsc#1045440) - Add RGB16_565 format to support 16-bit color depth sessions. (fate#323412, bsc#1024748) - Fix memory leak in meta_prop_get_values(). (bsc#1017412) - Implement _NET_RESTACK_WINDOW and respect the sibling field of XConfigureRequestEvent. This way X11 window stack operations work as expected. (bsc#1052058) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-49=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libmutter0-3.20.3-6.3.1 libmutter0-debuginfo-3.20.3-6.3.1 mutter-3.20.3-6.3.1 mutter-data-3.20.3-6.3.1 mutter-debuginfo-3.20.3-6.3.1 mutter-debugsource-3.20.3-6.3.1 mutter-devel-3.20.3-6.3.1 typelib-1_0-Meta-3_0-3.20.3-6.3.1 - openSUSE Leap 42.3 (noarch): mutter-lang-3.20.3-6.3.1 References: https://bugzilla.suse.com/1017412 https://bugzilla.suse.com/1024748 https://bugzilla.suse.com/1045440 https://bugzilla.suse.com/1052058 https://bugzilla.suse.com/1093541

1 0

openSUSE-RU-2019:0047-1: moderate: Recommended update for yast2-storage-ng
by maintenance＠opensuse.org 13 Jan '19

13 Jan '19

openSUSE Recommended Update: Recommended update for yast2-storage-ng ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0047-1 Rating: moderate References: #1059972 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-storage-ng provides the following fix: - partitioner: Do not allow to create BTRFS subvolumes with unsafe characters in the path. (bsc#1059972) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-47=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): yast2-storage-ng-4.0.216-lp150.2.21.1 References: https://bugzilla.suse.com/1059972

1 0

openSUSE-SU-2019:0050-1: moderate: Security update for aria2
by opensuse-security＠opensuse.org 13 Jan '19

13 Jan '19

openSUSE Security Update: Security update for aria2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0050-1 Rating: moderate References: #1120488 Cross-References: CVE-2019-3500 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for aria2 fixes the following security issue: - CVE-2019-3500: Metadata and potential password leaks via --log= (boo#1120488) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-50=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-50=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-50=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): aria2-1.24.0-4.4.1 aria2-debuginfo-1.24.0-4.4.1 aria2-debugsource-1.24.0-4.4.1 aria2-devel-1.24.0-4.4.1 libaria2-0-1.24.0-4.4.1 libaria2-0-debuginfo-1.24.0-4.4.1 - openSUSE Leap 42.3 (noarch): aria2-lang-1.24.0-4.4.1 - openSUSE Leap 15.0 (x86_64): aria2-1.33.1-lp150.2.4.1 aria2-debuginfo-1.33.1-lp150.2.4.1 aria2-debugsource-1.33.1-lp150.2.4.1 aria2-devel-1.33.1-lp150.2.4.1 libaria2-0-1.33.1-lp150.2.4.1 libaria2-0-debuginfo-1.33.1-lp150.2.4.1 - openSUSE Leap 15.0 (noarch): aria2-lang-1.33.1-lp150.2.4.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): aria2-1.33.1-bp150.3.7.1 aria2-devel-1.33.1-bp150.3.7.1 libaria2-0-1.33.1-bp150.3.7.1 - openSUSE Backports SLE-15 (noarch): aria2-lang-1.33.1-bp150.3.7.1 References: https://www.suse.com/security/cve/CVE-2019-3500.html https://bugzilla.suse.com/1120488

1 0

openSUSE-SU-2019:0048-1: important: Security update for irssi
by opensuse-security＠opensuse.org 13 Jan '19

13 Jan '19

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0048-1 Rating: important References: #1121396 Cross-References: CVE-2019-5882 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for irssi fixes the following issues: - CVE-2019-5882: Use after free when hidden lines were expired from the scroll buffer (boo#1121396) This update to the 1.1.2 version also fixes a number of stability issues and bugs. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-48=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): irssi-1.1.2-47.1 irssi-devel-1.1.2-47.1 References: https://www.suse.com/security/cve/CVE-2019-5882.html https://bugzilla.suse.com/1121396

1 0

openSUSE-SU-2019:0051-1: moderate: Security update for sssd
by opensuse-security＠opensuse.org 13 Jan '19

13 Jan '19

openSUSE Security Update: Security update for sssd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0051-1 Rating: moderate References: #1010700 #1072728 #1080156 #1087320 #1098377 #1101877 #1110299 Cross-References: CVE-2018-10852 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has 6 fixes is now available. Description: This update for sssd provides the following fixes: This security issue was fixed: - CVE-2018-10852: Set stricter permissions on /var/lib/sss/pipes/sudo to prevent the disclosure of sudo rules for arbitrary users (bsc#1098377) These non-security issues were fixed: - Fix a segmentation fault in sss_cache command. (bsc#1072728) - Fix a failure in autofs initialisation sequence upon system boot. (bsc#1010700) - Fix race condition on boot between SSSD and autofs. (bsc#1010700) - Fix a bug where file descriptors were not closed (bsc#1080156) - Fix an issue where sssd logs were not rotated properly (bsc#1080156) - Remove whitespaces from netgroup entries (bsc#1087320) - Remove misleading log messages (bsc#1101877) - exit() the forked process if exec()-ing a child process fails (bsc#1110299) - Do not schedule the machine renewal task if adcli is not executable (bsc#1110299) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-51=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libipa_hbac-devel-1.13.4-12.1 libipa_hbac0-1.13.4-12.1 libipa_hbac0-debuginfo-1.13.4-12.1 libsss_idmap-devel-1.13.4-12.1 libsss_idmap0-1.13.4-12.1 libsss_idmap0-debuginfo-1.13.4-12.1 libsss_nss_idmap-devel-1.13.4-12.1 libsss_nss_idmap0-1.13.4-12.1 libsss_nss_idmap0-debuginfo-1.13.4-12.1 libsss_sudo-1.13.4-12.1 libsss_sudo-debuginfo-1.13.4-12.1 python-ipa_hbac-1.13.4-12.1 python-ipa_hbac-debuginfo-1.13.4-12.1 python-sss_nss_idmap-1.13.4-12.1 python-sss_nss_idmap-debuginfo-1.13.4-12.1 python-sssd-config-1.13.4-12.1 python-sssd-config-debuginfo-1.13.4-12.1 sssd-1.13.4-12.1 sssd-ad-1.13.4-12.1 sssd-ad-debuginfo-1.13.4-12.1 sssd-debuginfo-1.13.4-12.1 sssd-debugsource-1.13.4-12.1 sssd-ipa-1.13.4-12.1 sssd-ipa-debuginfo-1.13.4-12.1 sssd-krb5-1.13.4-12.1 sssd-krb5-common-1.13.4-12.1 sssd-krb5-common-debuginfo-1.13.4-12.1 sssd-krb5-debuginfo-1.13.4-12.1 sssd-ldap-1.13.4-12.1 sssd-ldap-debuginfo-1.13.4-12.1 sssd-proxy-1.13.4-12.1 sssd-proxy-debuginfo-1.13.4-12.1 sssd-tools-1.13.4-12.1 sssd-tools-debuginfo-1.13.4-12.1 - openSUSE Leap 42.3 (x86_64): sssd-32bit-1.13.4-12.1 sssd-debuginfo-32bit-1.13.4-12.1 References: https://www.suse.com/security/cve/CVE-2018-10852.html https://bugzilla.suse.com/1010700 https://bugzilla.suse.com/1072728 https://bugzilla.suse.com/1080156 https://bugzilla.suse.com/1087320 https://bugzilla.suse.com/1098377 https://bugzilla.suse.com/1101877 https://bugzilla.suse.com/1110299

1 0

openSUSE-RU-2019:0028-1: moderate: Recommended update for yast2-network
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for yast2-network ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0028-1 Rating: moderate References: #1103712 #1105230 #1107470 #1108852 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for yast2-network provides the following fixes: - Fixes to the networking AutoYaST schema. (bsc#1103712, bsc#1108852) * Permitted the use of 'listentry' element in list entries. * Added missed s390 device 'layer2' boolean element. - Does no longer crash with internal error when 0.0.0.0 netmask is used in the routing tab. (bsc#1105230) - Fix a problem that was causing duplicate entry for network devices in 70-persistent-net-rules. (bsc#1107470) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-28=1 Package List: - openSUSE Leap 42.3 (noarch): yast2-network-3.2.55-18.1 References: https://bugzilla.suse.com/1103712 https://bugzilla.suse.com/1105230 https://bugzilla.suse.com/1107470 https://bugzilla.suse.com/1108852

1 0

openSUSE-RU-2019:0017-1: moderate: Recommended update for sxiv
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for sxiv ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0017-1 Rating: moderate References: #1104541 Affected Products: openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for sxiv contains the following bug fix: - sxiv may have failed to load images due to a missing dependency on imlib2-loaders (boo#1104541) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-17=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-17=1 Package List: - openSUSE Leap 15.0 (x86_64): sxiv-24-lp150.2.3.1 sxiv-debuginfo-24-lp150.2.3.1 sxiv-debugsource-24-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): sxiv-24-bp150.3.3.1 sxiv-debuginfo-24-bp150.3.3.1 sxiv-debugsource-24-bp150.3.3.1 References: https://bugzilla.suse.com/1104541

1 0

openSUSE-RU-2019:0024-1: moderate: Recommended update for crmsh
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for crmsh ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0024-1 Rating: moderate References: #1111202 #1111579 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for crmsh provides the following fixes: - Fix an issue where 'crm configure edit' displayed several warnings when editing a bootstrap option. (bsc#1111202) - cibconfig: Normalize - to _ in parameter names. (bsc#1111579) - ra: Handle the obsoletes attribute. (bsc#1111579) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-24=1 Package List: - openSUSE Leap 42.3 (noarch): crmsh-3.0.3-10.6.1 crmsh-scripts-3.0.3-10.6.1 crmsh-test-3.0.3-10.6.1 References: https://bugzilla.suse.com/1111202 https://bugzilla.suse.com/1111579

1 0

openSUSE-RU-2019:0037-1: moderate: Recommended update for kernel-firmware
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for kernel-firmware ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0037-1 Rating: moderate References: #1101818 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kernel-firmware provides the following improvements: - Changes in version 20181026 (fate#326045, fate#325856, fate#326294): * qed: Add 8.37.7.0 firmware image. * amdgpu: Add raven dmcu firmware. * amdgpu: Update raven firmware to 18.40. * amdgpu: Update fiji firmware to 18.40. * amdgpu: Update tonga firmware to 18.40. * amdgpu: Update carrizo firmware to 18.40. * amdgpu: Update polaris10 firmware to 18.40. * amdgpu: Update vega10 firmware to 18.40. * linux-firmware: Add firmware for mt7650e. * linux-firmware: Add MC firmware for NXP DPAA2 SoCs. * linux-firmware: Liquidio: Fix GPL compliance issue. * linux-firmware: Update firmware file for Intel Bluetooth,8265. * linux-firmware: Update firmware patch for Intel Bluetooth 8260. * linux-firmware: Update firmware file for Intel Bluetooth,9260. * linux-firmware: Update firmware file for Intel Bluetooth,9560. * linux-firmware: Add firmware for mt7610e. * Update Intel OPA hfi1 firmware. * ath10k: QCA9984 hw1.0: Update board-2.bin. * ath10k: QCA9984 hw1.0: Update firmware-5.bin to 10.4-3.6.0.1-00003. * ath10k: QCA988X hw2.0: Update firmware-5.bin to 10.2.4-1.0-00041. * ath10k: QCA9888 hw2.0: Update board-2.bin. * ath10k: QCA9888 hw2.0: Update firmware-5.bin to 10.4-3.6-00140. * ath10k: QCA9887 hw1.0: Update firmware-5.bin to 10.2.4-1.0-00041. * ath10k: QCA9377 hw1.0: Add firmware-6.bin to WLAN.TF.2.1-00021-QCARMSWP-1. * ath10k: QCA6174 hw3.0: Update firmware-6.bin to RM.4.4.1.c2-00057-QCARMSWP-1. * ath10k: QCA4019 hw1.0: Update board-2.bin. * ath10k: QCA4019 hw1.0: Update firmware-5.bin to 10.4-3.6-00140. * nfp: Add Agilio BPF firmware rev 2.0.6.124. * rtw88: Add firmware file for driver rtw88. * nfp: Update Agilio SmartNIC flower firmware to rev AOTC-2.9.A.37. * iwlwifi: Add -41.ucode firmwares for 9000 series. * iwlwifi: Update firmwares for 9000 series. * iwlwifi: Update firmwares for 7000, 8000 and 9000 series. * nfp: Update Agilio SmartNIC firmware to rev 2.1.13. - Changes in version 20181001 (fate#326291,fate#326079): * ti-connectivity: Add firmware for CC2560(A) Bluetooth. * linux-firmware: mediatek: Add firmware for mt7668u Bluetooth. * nvidia: Add GV100 signed firmware. * firmware/icl/dmc: Add v1.07 of DMC for Icelake. * linux-firmware: Add Marvell SD8997 firmware image. * qca: Update BT firmware files for QCA ROME chip. - Changes in version 20180913: * brcm: Update firmware for bcm43362 sdio. * Mellanox: Add new mlxsw_spectrum firmware 13.1703.4. * rtl_bt: Add firmware and configuration files for the Bluetooth part of RTL8822CU. * nvidia: Switch GP10[2467] to newer scrubber/ACR firmware (from GP108). - Changes in version 20180825: * amdgpu: Sync up polaris10 firmware with 18.30 release. * amdgpu: Sync up vega10 firmware with 18.30 release. * amdgpu: Sync up raven firmware with 18.30 release. * amdgpu: Sync up polaris12 firmware with 18.30 release. * amdgpu: Sync up tonga firmware with 18.30 release. * amdgpu: Sync up polaris11 firmware with 18.30 release. * amdgpu: Sync up fiji firmware with 18.30 release. * linux-firmware: Add firmware for mhdp8546. * qed: Add firmware 8.37.7.0. - Changes in version 20180814: * linux-firmware: Update firmware patch for Intel Bluetooth 7265 (D1). * linux-firmware: Update firmware file for Intel Bluetooth,9560. * linux-firmware: Update firmware file for Intel Bluetooth,9260. * linux-firmware: Update firmware file for Intel Bluetooth,8265. * linux-firmware: Update firmware patch for Intel Bluetooth 8260. * linux-firmware: Add firmware for mt76x0. * qcom: Update venus firmware files for v5.2. * nfp: Update Agilio SmartNIC flower firmware to rev AOTC-2.9.A.31. - Changes in version 20180730: * linux-firmware: Add firmware for mt76x2u. * wl18xx: Update firmware file 8.9.0.0.79. * Mellanox: Add new mlxsw_spectrum firmware 13.1702.6. * WHENCE: Remove reference to amdgpu/vegam_me_2.bin. * linux-firmware: mediatek: Add MT7622 Bluetooth firmwares and license file. * brcm: Add 43430 based AP6212 and 1DX NVRAM. * linux-firmware: Update Marvell USB8801 B0 firmware image. - Changes in version 20180717: * amdgpu: Update copyright date. * amdgpu: Add initial VegaM firmware. * amdgpu: Sync up vega10 firmware with 18.20 release. * amdgpu: Sync up raven firmware with 18.20 release. * amdgpu: Sync up polaris12 firmware with 18.20 release. * amdgpu: Sync up polaris11 firmware with 18.20 release. * amdgpu: Sync up polaris10 firmware with 18.20 release. * amdgpu: Sync up verde firmware with 18.20 release. * amdgpu: Sync up pitcairn firmware with 18.20 release. * amdgpu: Sync up tahiti firmware with 18.20 release. * amdgpu: Sync up oland firmware with 18.20 release. * amdgpu: Sync up hainan firmware with 18.20 release. * amdgpu: Sync up kaveri firmware with 18.20 release. * amdgpu: Sync up mullins firmware with 18.20 release. * amdgpu: Sync up kabini firmware with 18.20 release. * amdgpu: Sync up hawaii firmware with 18.20 release. * amdgpu: Sync up bonaire firmware with 18.20 release. * WHENCE: Fix typo Version. * cxgb4: Update firmware to revision 1.20.8.0. - Changes in version 20180606: * brcm: Update firmware for bcm4356 pcie. * brcm: Update firmware for bcm4354 sdio. * brcm: Update firmware for bcm43362 sdio. * brcm: Update firmware for bcm43340 sdio. * brcm: Update firmware for bcm43430 sdio. * Update Cypress license termination clause. * amdgpu: Update vega10 VCE firmware to version 55.3. * linux-firmware: Update firmware patch for Intel Bluetooth 7265 (D0). * linux-firmware: Update firmware patch for Intel Bluetooth 7265 (D1). * qcom: Add venus firmware files for v5.2. * linux-firmware: liquidio: Update vswitch firmware to v1.7.2. - Remove unnecessary python dependency. (bsc#1101818) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-37=1 Package List: - openSUSE Leap 15.0 (noarch): kernel-firmware-20181026-lp150.2.6.1 ucode-amd-20181026-lp150.2.6.1 References: https://bugzilla.suse.com/1101818

1 0

openSUSE-RU-2019:0041-1: moderate: Recommended update for ceph
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0041-1 Rating: moderate References: #1109009 #1110415 #1110416 #1110419 #1112872 #1114414 #1116205 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update for ceph fixes the following issues: * rgw: resharding produces invalid values of bucket stats (bsc#1110419) * rgw: Fix log level of gc_iterate_entries (bsc#1114414) * rgw: dynamic reshard fixe (bsc#1109009) * bsc#1110415, bsc#1110416 # rgw: es module: set compression type correctly # rgw: ES sync: be more restrictive on object system attrs # rgw: ES sync: wrap all the decode bls in try block # rgw: librgw: initialize curl and http client for multisite * bsc#1116205, bsc#1112872 # rgw: allow init complete to proceed in case of erroneus zone deletes # rgw: period update: check for dangling master zone references # tests: tests for master zone deletion # tests: rgw: test_multi: python 2-3 compatibility This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-41=1 Package List: - openSUSE Leap 42.3 (x86_64): ceph-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-base-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-base-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-common-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-common-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-debugsource-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-fuse-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-fuse-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-mds-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-mds-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-mgr-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-mgr-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-mon-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-mon-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-osd-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-osd-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-radosgw-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-radosgw-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-resource-agents-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-test-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-test-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 ceph-test-debugsource-12.2.10+git.1544718327.fc6f0c7299-18.1 libcephfs-devel-12.2.10+git.1544718327.fc6f0c7299-18.1 libcephfs2-12.2.10+git.1544718327.fc6f0c7299-18.1 libcephfs2-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 librados-devel-12.2.10+git.1544718327.fc6f0c7299-18.1 librados-devel-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 librados2-12.2.10+git.1544718327.fc6f0c7299-18.1 librados2-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 libradosstriper-devel-12.2.10+git.1544718327.fc6f0c7299-18.1 libradosstriper1-12.2.10+git.1544718327.fc6f0c7299-18.1 libradosstriper1-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 librbd-devel-12.2.10+git.1544718327.fc6f0c7299-18.1 librbd1-12.2.10+git.1544718327.fc6f0c7299-18.1 librbd1-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 librgw-devel-12.2.10+git.1544718327.fc6f0c7299-18.1 librgw2-12.2.10+git.1544718327.fc6f0c7299-18.1 librgw2-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 python-ceph-compat-12.2.10+git.1544718327.fc6f0c7299-18.1 python-cephfs-12.2.10+git.1544718327.fc6f0c7299-18.1 python-cephfs-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 python-rados-12.2.10+git.1544718327.fc6f0c7299-18.1 python-rados-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 python-rbd-12.2.10+git.1544718327.fc6f0c7299-18.1 python-rbd-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 python-rgw-12.2.10+git.1544718327.fc6f0c7299-18.1 python-rgw-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 python3-ceph-argparse-12.2.10+git.1544718327.fc6f0c7299-18.1 python3-cephfs-12.2.10+git.1544718327.fc6f0c7299-18.1 python3-cephfs-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 python3-rados-12.2.10+git.1544718327.fc6f0c7299-18.1 python3-rados-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 python3-rbd-12.2.10+git.1544718327.fc6f0c7299-18.1 python3-rbd-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 python3-rgw-12.2.10+git.1544718327.fc6f0c7299-18.1 python3-rgw-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 rados-objclass-devel-12.2.10+git.1544718327.fc6f0c7299-18.1 rbd-fuse-12.2.10+git.1544718327.fc6f0c7299-18.1 rbd-fuse-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 rbd-mirror-12.2.10+git.1544718327.fc6f0c7299-18.1 rbd-mirror-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 rbd-nbd-12.2.10+git.1544718327.fc6f0c7299-18.1 rbd-nbd-debuginfo-12.2.10+git.1544718327.fc6f0c7299-18.1 References: https://bugzilla.suse.com/1109009 https://bugzilla.suse.com/1110415 https://bugzilla.suse.com/1110416 https://bugzilla.suse.com/1110419 https://bugzilla.suse.com/1112872 https://bugzilla.suse.com/1114414 https://bugzilla.suse.com/1116205

1 0

openSUSE-RU-2019:0023-1: Recommended update for acl
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for acl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0023-1 Rating: low References: #953659 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for acl fixes the following issues: - quote: Escape literal backslashes (bsc#953659). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-23=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): acl-2.2.52-11.3.1 acl-debuginfo-2.2.52-11.3.1 acl-debugsource-2.2.52-11.3.1 libacl-devel-2.2.52-11.3.1 libacl1-2.2.52-11.3.1 libacl1-debuginfo-2.2.52-11.3.1 - openSUSE Leap 42.3 (x86_64): libacl-devel-32bit-2.2.52-11.3.1 libacl1-32bit-2.2.52-11.3.1 libacl1-debuginfo-32bit-2.2.52-11.3.1 References: https://bugzilla.suse.com/953659

1 0

openSUSE-RU-2019:0040-1: moderate: Recommended update for apache2
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0040-1 Rating: moderate References: #1108989 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for apache2 provides the following fix: - Fix full scoreboard error. (bsc#1108989) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-40=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-2.4.23-34.1 apache2-debuginfo-2.4.23-34.1 apache2-debugsource-2.4.23-34.1 apache2-devel-2.4.23-34.1 apache2-event-2.4.23-34.1 apache2-event-debuginfo-2.4.23-34.1 apache2-example-pages-2.4.23-34.1 apache2-prefork-2.4.23-34.1 apache2-prefork-debuginfo-2.4.23-34.1 apache2-utils-2.4.23-34.1 apache2-utils-debuginfo-2.4.23-34.1 apache2-worker-2.4.23-34.1 apache2-worker-debuginfo-2.4.23-34.1 - openSUSE Leap 42.3 (noarch): apache2-doc-2.4.23-34.1 References: https://bugzilla.suse.com/1108989

1 0

openSUSE-RU-2019:0032-1: moderate: Recommended update for python3-ec2uploadimg
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for python3-ec2uploadimg ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0032-1 Rating: moderate References: #1118027 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python3-ec2uploadimg fixes the following issues: - Support ARM architecture (bsc#1118027) - Use the proper subnet if no default subnet exists in the account This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-32=1 Package List: - openSUSE Leap 15.0 (noarch): python3-ec2uploadimg-5.0.1-lp150.2.3.1 References: https://bugzilla.suse.com/1118027

1 0

openSUSE-RU-2019:0027-1: moderate: Recommended update for yast2
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for yast2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0027-1 Rating: moderate References: #1093052 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2 fixes the following issues: yast2: - When only one firewall is installed but not running, choose it instead of the default SuSEfirewall2 (bsc#1093052). yast2-firewall: - YaST now installs SuSEFirewall2 when it is selected as the firewall backend (bsc#1093052) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-27=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): yast2-3.2.46-2.9.1 - openSUSE Leap 42.3 (noarch): yast2-firewall-3.2.1-2.3.1 References: https://bugzilla.suse.com/1093052

1 0

openSUSE-RU-2019:0030-1: important: Recommended update for yast2-bootloader
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for yast2-bootloader ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0030-1 Rating: important References: #1070233 #1093838 #1119781 #1119919 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for yast2-bootloader fixes the following issues: - Do not crash when clicking on booting during upgrade (bsc#1070233,bsc#1093838,bsc#1119919,bsc#1119781) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-30=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): yast2-bootloader-3.2.27.3-13.1 References: https://bugzilla.suse.com/1070233 https://bugzilla.suse.com/1093838 https://bugzilla.suse.com/1119781 https://bugzilla.suse.com/1119919

1 0

openSUSE-RU-2019:0026-1: moderate: Recommended update for gnome-control-center
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for gnome-control-center ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0026-1 Rating: moderate References: #1078968 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gnome-control-center provides the following fix: - user-accounts: Remove implicit language setting when a new user navigates to the user panel for the first time. (bsc#1078968) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-26=1 Package List: - openSUSE Leap 42.3 (x86_64): gnome-control-center-3.20.1-18.3.1 gnome-control-center-color-3.20.1-18.3.1 gnome-control-center-debuginfo-3.20.1-18.3.1 gnome-control-center-debugsource-3.20.1-18.3.1 gnome-control-center-devel-3.20.1-18.3.1 gnome-control-center-goa-3.20.1-18.3.1 gnome-control-center-user-faces-3.20.1-18.3.1 - openSUSE Leap 42.3 (noarch): gnome-control-center-lang-3.20.1-18.3.1 References: https://bugzilla.suse.com/1078968

1 0

openSUSE-RU-2019:0029-1: Recommended update for acl
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for acl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0029-1 Rating: low References: #953659 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for acl fixes the following issues: - test: Add helper library to fake passwd/group files. - quote: Escape literal backslashes. (bsc#953659) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-29=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): acl-2.2.52-lp150.3.3.1 acl-debuginfo-2.2.52-lp150.3.3.1 acl-debugsource-2.2.52-lp150.3.3.1 libacl-devel-2.2.52-lp150.3.3.1 libacl1-2.2.52-lp150.3.3.1 libacl1-debuginfo-2.2.52-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): libacl-devel-32bit-2.2.52-lp150.3.3.1 libacl1-32bit-2.2.52-lp150.3.3.1 libacl1-32bit-debuginfo-2.2.52-lp150.3.3.1 References: https://bugzilla.suse.com/953659

1 0

openSUSE-RU-2019:0018-1: Recommended update for gnucash-docs
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for gnucash-docs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0018-1 Rating: low References: #1099804 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gnucash-docs fixes the following issue: - gnucash-docs did not recommend gnome-help and may have been unable to retrieve and open guide files (boo#1099804) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-18=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-18=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-18=1 Package List: - openSUSE Leap 42.3 (noarch): gnucash-docs-2.6.16-8.3.1 - openSUSE Leap 15.0 (noarch): gnucash-docs-3.0-lp150.2.3.1 - openSUSE Backports SLE-15 (noarch): gnucash-docs-3.0-bp150.3.3.1 References: https://bugzilla.suse.com/1099804

1 0

openSUSE-SU-2019:0022-1: important: Security update for gthumb
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for gthumb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0022-1 Rating: important References: #1113749 Cross-References: CVE-2018-18718 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gthumb fixes the following issues: Security issue fixed: - CVE-2018-18718: Fixed a double-free in add_themes_from_dir function from dlg-contact-sheet.c (boo#1113749) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-22=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-22=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-22=1 Package List: - openSUSE Leap 42.3 (noarch): gthumb-lang-3.4.2-7.3.1 - openSUSE Leap 42.3 (x86_64): gthumb-3.4.2-7.3.1 gthumb-debuginfo-3.4.2-7.3.1 gthumb-debugsource-3.4.2-7.3.1 gthumb-devel-3.4.2-7.3.1 - openSUSE Leap 15.0 (x86_64): gthumb-3.6.1-lp150.3.3.1 gthumb-debuginfo-3.6.1-lp150.3.3.1 gthumb-debugsource-3.6.1-lp150.3.3.1 gthumb-devel-3.6.1-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): gthumb-lang-3.6.1-lp150.3.3.1 - openSUSE Backports SLE-15 (x86_64): gthumb-3.6.1-bp150.2.3.1 gthumb-devel-3.6.1-bp150.2.3.1 - openSUSE Backports SLE-15 (noarch): gthumb-lang-3.6.1-bp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-18718.html https://bugzilla.suse.com/1113749

1 0

openSUSE-SU-2019:0042-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0042-1 Rating: important References: #1101644 #1101645 #1101651 #1101656 #1112142 #1112143 #1112144 #1112146 #1112147 #1112152 #1112153 Cross-References: CVE-2018-13785 CVE-2018-16435 CVE-2018-2938 CVE-2018-2940 CVE-2018-2952 CVE-2018-2973 CVE-2018-3136 CVE-2018-3139 CVE-2018-3149 CVE-2018-3169 CVE-2018-3180 CVE-2018-3214 CVE-2018-3639 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update for java-1_7_0-openjdk to version 7u201 fixes the following issues: Security issues fixed: - CVE-2018-3136: Manifest better support (bsc#1112142) - CVE-2018-3139: Better HTTP Redirection (bsc#1112143) - CVE-2018-3149: Enhance JNDI lookups (bsc#1112144) - CVE-2018-3169: Improve field accesses (bsc#1112146) - CVE-2018-3180: Improve TLS connections stability (bsc#1112147) - CVE-2018-3214: Better RIFF reading support (bsc#1112152) - CVE-2018-13785: Upgrade JDK 8u to libpng 1.6.35 (bsc#1112153) - CVE-2018-16435: heap-based buffer overflow in SetData function in cmsIT8LoadFromFile - CVE-2018-2938: Support Derby connections (bsc#1101644) - CVE-2018-2940: Better stack walking (bsc#1101645) - CVE-2018-2952: Exception to Pattern Syntax (bsc#1101651) - CVE-2018-2973: Improve LDAP support (bsc#1101656) - CVE-2018-3639 cpu speculative store bypass mitigation This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-42=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_7_0-openjdk-1.7.0.201-54.1 java-1_7_0-openjdk-accessibility-1.7.0.201-54.1 java-1_7_0-openjdk-bootstrap-1.7.0.201-54.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.201-54.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.201-54.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.201-54.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.201-54.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.201-54.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.201-54.1 java-1_7_0-openjdk-debuginfo-1.7.0.201-54.1 java-1_7_0-openjdk-debugsource-1.7.0.201-54.1 java-1_7_0-openjdk-demo-1.7.0.201-54.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.201-54.1 java-1_7_0-openjdk-devel-1.7.0.201-54.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.201-54.1 java-1_7_0-openjdk-headless-1.7.0.201-54.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.201-54.1 java-1_7_0-openjdk-src-1.7.0.201-54.1 - openSUSE Leap 42.3 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.201-54.1 References: https://www.suse.com/security/cve/CVE-2018-13785.html https://www.suse.com/security/cve/CVE-2018-16435.html https://www.suse.com/security/cve/CVE-2018-2938.html https://www.suse.com/security/cve/CVE-2018-2940.html https://www.suse.com/security/cve/CVE-2018-2952.html https://www.suse.com/security/cve/CVE-2018-2973.html https://www.suse.com/security/cve/CVE-2018-3136.html https://www.suse.com/security/cve/CVE-2018-3139.html https://www.suse.com/security/cve/CVE-2018-3149.html https://www.suse.com/security/cve/CVE-2018-3169.html https://www.suse.com/security/cve/CVE-2018-3180.html https://www.suse.com/security/cve/CVE-2018-3214.html https://www.suse.com/security/cve/CVE-2018-3639.html https://bugzilla.suse.com/1101644 https://bugzilla.suse.com/1101645 https://bugzilla.suse.com/1101651 https://bugzilla.suse.com/1101656 https://bugzilla.suse.com/1112142 https://bugzilla.suse.com/1112143 https://bugzilla.suse.com/1112144 https://bugzilla.suse.com/1112146 https://bugzilla.suse.com/1112147 https://bugzilla.suse.com/1112152 https://bugzilla.suse.com/1112153

1 0

openSUSE-RU-2019:0035-1: moderate: Recommended update for osinfo-db
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for osinfo-db ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0035-1 Rating: moderate References: #1086715 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for osinfo-db fixes the following issues: - Add correct release date for SLE12-SP4 - Update database to versions 20181116,20181011 - Add support for sle15sp1 (bsc#1086715) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-35=1 Package List: - openSUSE Leap 42.3 (noarch): osinfo-db-20181116-14.1 References: https://bugzilla.suse.com/1086715

1 0

openSUSE-RU-2019:0031-1: moderate: Recommended update for rollback-helper
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for rollback-helper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0031-1 Rating: moderate References: #1088552 #1108618 #1113048 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for rollback-helper fixes the following issues: - Run before any other services calling zypper (bsc#1113048) - Retry network connection if it doesn't work yet (bsc#1108618) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-31=1 Package List: - openSUSE Leap 42.3 (noarch): rollback-helper-1.0+git20181112.65db4d0-3.6.1 References: https://bugzilla.suse.com/1088552 https://bugzilla.suse.com/1108618 https://bugzilla.suse.com/1113048

1 0

openSUSE-SU-2019:0045-1: important: Security update for LibVNCServer
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for LibVNCServer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0045-1 Rating: important References: #1120114 #1120115 #1120116 #1120117 #1120118 #1120119 #1120120 #1120121 #1120122 Cross-References: CVE-2018-15126 CVE-2018-15127 CVE-2018-20019 CVE-2018-20020 CVE-2018-20021 CVE-2018-20022 CVE-2018-20023 CVE-2018-20024 CVE-2018-6307 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for LibVNCServer fixes the following issues: Security issues fixed: - CVE-2018-15126: Fixed use-after-free in file transfer extension (bsc#1120114) - CVE-2018-6307: Fixed use-after-free in file transfer extension server code (bsc#1120115) - CVE-2018-20020: Fixed heap out-of-bound write inside structure in VNC client code (bsc#1120116) - CVE-2018-15127: Fixed heap out-of-bounds write in rfbserver.c (bsc#1120117) - CVE-2018-20019: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1120118) - CVE-2018-20023: Fixed information disclosure through improper initialization in VNC Repeater client code (bsc#1120119) - CVE-2018-20022: Fixed information disclosure through improper initialization in VNC client code (bsc#1120120) - CVE-2018-20024: Fixed NULL pointer dereference in VNC client code (bsc#1120121) - CVE-2018-20021: Fixed infinite loop in VNC client code (bsc#1120122) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-45=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): LibVNCServer-debugsource-0.9.9-16.6.1 LibVNCServer-devel-0.9.9-16.6.1 libvncclient0-0.9.9-16.6.1 libvncclient0-debuginfo-0.9.9-16.6.1 libvncserver0-0.9.9-16.6.1 libvncserver0-debuginfo-0.9.9-16.6.1 linuxvnc-0.9.9-16.6.1 linuxvnc-debuginfo-0.9.9-16.6.1 References: https://www.suse.com/security/cve/CVE-2018-15126.html https://www.suse.com/security/cve/CVE-2018-15127.html https://www.suse.com/security/cve/CVE-2018-20019.html https://www.suse.com/security/cve/CVE-2018-20020.html https://www.suse.com/security/cve/CVE-2018-20021.html https://www.suse.com/security/cve/CVE-2018-20022.html https://www.suse.com/security/cve/CVE-2018-20023.html https://www.suse.com/security/cve/CVE-2018-20024.html https://www.suse.com/security/cve/CVE-2018-6307.html https://bugzilla.suse.com/1120114 https://bugzilla.suse.com/1120115 https://bugzilla.suse.com/1120116 https://bugzilla.suse.com/1120117 https://bugzilla.suse.com/1120118 https://bugzilla.suse.com/1120119 https://bugzilla.suse.com/1120120 https://bugzilla.suse.com/1120121 https://bugzilla.suse.com/1120122

1 0

openSUSE-OU-2019:0034-1: Optional update to add brotli
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Optional Update: Optional update to add brotli ______________________________________________________________________________ Announcement ID: openSUSE-OU-2019:0034-1 Rating: low References: #1106391 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update supplies the brotli compressor. (FATE#326659) It is a requirement for an upcoming webkit2gtk3 update. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-34=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): brotli-1.0.2-2.1 brotli-debuginfo-1.0.2-2.1 brotli-debugsource-1.0.2-2.1 libbrotli-devel-1.0.2-2.1 libbrotlicommon1-1.0.2-2.1 libbrotlicommon1-debuginfo-1.0.2-2.1 libbrotlidec1-1.0.2-2.1 libbrotlidec1-debuginfo-1.0.2-2.1 libbrotlienc1-1.0.2-2.1 libbrotlienc1-debuginfo-1.0.2-2.1 References: https://bugzilla.suse.com/1106391

1 0

openSUSE-SU-2019:0044-1: important: Security update for haproxy
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for haproxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0044-1 Rating: important References: #1119368 #1119419 Cross-References: CVE-2018-20102 CVE-2018-20103 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for haproxy to version 1.8.15 fixes the following issues: Security issues fixed: - CVE-2018-20102: Fixed an out-of-bounds read in dns_validate_dns_response(), which allowed for memory disclosure (bsc#1119368) - CVE-2018-20103: Fixed an infinite recursion via crafted packet allows stack exhaustion and denial of service (bsc#1119419) Other notable bug fixes: - Fix off-by-one write in dns_validate_dns_response() - Fix out-of-bounds read via signedness error in dns_validate_dns_response() - Prevent out-of-bounds read in dns_validate_dns_response() - Prevent out-of-bounds read in dns_read_name() - Prevent stack-exhaustion via recursion loop in dns_read_name For a full list of changes, please refer to: https://www.haproxy.org/download/1.8/src/CHANGELOG This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-44=1 Package List: - openSUSE Leap 15.0 (x86_64): haproxy-1.8.15~git0.6b6a350a-lp150.2.6.1 haproxy-debuginfo-1.8.15~git0.6b6a350a-lp150.2.6.1 haproxy-debugsource-1.8.15~git0.6b6a350a-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-20102.html https://www.suse.com/security/cve/CVE-2018-20103.html https://bugzilla.suse.com/1119368 https://bugzilla.suse.com/1119419

1 0

openSUSE-SU-2019:0020-1: moderate: Security update for gpg2
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for gpg2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0020-1 Rating: moderate References: #1120346 Cross-References: CVE-2018-1000858 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gpg2 fixes the following issue: Security issue fixed: - CVE-2018-1000858: Fixed a Cross Site Request Forgery(CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF (bsc#1120346). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-20=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): gpg2-2.2.5-lp150.3.6.1 gpg2-debuginfo-2.2.5-lp150.3.6.1 gpg2-debugsource-2.2.5-lp150.3.6.1 - openSUSE Leap 15.0 (noarch): gpg2-lang-2.2.5-lp150.3.6.1 References: https://www.suse.com/security/cve/CVE-2018-1000858.html https://bugzilla.suse.com/1120346

1 0

openSUSE-RU-2019:0025-1: moderate: Recommended update for gdb
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for gdb ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0025-1 Rating: moderate References: #1109013 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gdb provides the following fix: - Fix a crash when reading core. (bsc#1109013) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-25=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gdb-8.2-10.1 gdb-debuginfo-8.2-10.1 gdb-debugsource-8.2-10.1 gdb-testresults-8.2-10.1 gdbserver-8.2-10.1 gdbserver-debuginfo-8.2-10.1 References: https://bugzilla.suse.com/1109013

1 0

openSUSE-RU-2019:0038-1: moderate: Recommended update for osinfo-db
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for osinfo-db ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0038-1 Rating: moderate References: #1086715 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for osinfo-db fixes the following issues: - Add correct release date for SLE12-SP4. - Update database to versions 20181116, 20181011, 20180920, 20180903. - Add support for sle15sp1. (bsc#1086715) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-38=1 Package List: - openSUSE Leap 15.0 (noarch): osinfo-db-20181116-lp150.2.9.1 References: https://bugzilla.suse.com/1086715

1 0

openSUSE-RU-2019:0036-1: moderate: Recommended update for gdm
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for gdm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0036-1 Rating: moderate References: #1112834 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gdm fixes the following issues: - Ignore duplicate desktop file with same "Name" value, including symlinks of desktop files. (bsc#1112834) - Drop the hardcoded "default.desktop" as LightDM and SDDM use symlinks as aliases. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-36=1 Package List: - openSUSE Leap 15.0 (noarch): gdm-branding-upstream-3.26.2.1-lp150.11.6.1 gdm-lang-3.26.2.1-lp150.11.6.1 gdmflexiserver-3.26.2.1-lp150.11.6.1 - openSUSE Leap 15.0 (x86_64): gdm-3.26.2.1-lp150.11.6.1 gdm-debuginfo-3.26.2.1-lp150.11.6.1 gdm-debugsource-3.26.2.1-lp150.11.6.1 gdm-devel-3.26.2.1-lp150.11.6.1 libgdm1-3.26.2.1-lp150.11.6.1 libgdm1-debuginfo-3.26.2.1-lp150.11.6.1 typelib-1_0-Gdm-1_0-3.26.2.1-lp150.11.6.1 References: https://bugzilla.suse.com/1112834

1 0

openSUSE-RU-2019:0033-1: moderate: Recommended update for apparmor
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for apparmor ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0033-1 Rating: moderate References: #1111345 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for apparmor fixes the following issues: - Update the last dnsmasq fix for logfiles when running under apparmor (bsc#1111345) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-33=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): apache2-mod_apparmor-2.12-lp150.6.6.1 apache2-mod_apparmor-debuginfo-2.12-lp150.6.6.1 apparmor-debugsource-2.12-lp150.6.6.1 apparmor-parser-2.12-lp150.6.6.1 apparmor-parser-debuginfo-2.12-lp150.6.6.1 libapparmor-debugsource-2.12-lp150.6.6.1 libapparmor-devel-2.12-lp150.6.6.1 libapparmor1-2.12-lp150.6.6.1 libapparmor1-debuginfo-2.12-lp150.6.6.1 pam_apparmor-2.12-lp150.6.6.1 pam_apparmor-debuginfo-2.12-lp150.6.6.1 perl-apparmor-2.12-lp150.6.6.1 perl-apparmor-debuginfo-2.12-lp150.6.6.1 python3-apparmor-2.12-lp150.6.6.1 python3-apparmor-debuginfo-2.12-lp150.6.6.1 ruby-apparmor-2.12-lp150.6.6.1 ruby-apparmor-debuginfo-2.12-lp150.6.6.1 - openSUSE Leap 15.0 (noarch): apparmor-abstractions-2.12-lp150.6.6.1 apparmor-docs-2.12-lp150.6.6.1 apparmor-parser-lang-2.12-lp150.6.6.1 apparmor-profiles-2.12-lp150.6.6.1 apparmor-utils-2.12-lp150.6.6.1 apparmor-utils-lang-2.12-lp150.6.6.1 - openSUSE Leap 15.0 (x86_64): libapparmor1-32bit-2.12-lp150.6.6.1 libapparmor1-32bit-debuginfo-2.12-lp150.6.6.1 pam_apparmor-32bit-2.12-lp150.6.6.1 pam_apparmor-32bit-debuginfo-2.12-lp150.6.6.1 References: https://bugzilla.suse.com/1111345

1 0

openSUSE-RU-2019:0039-1: moderate: Recommended update for xfsprogs
by maintenance＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Recommended Update: Recommended update for xfsprogs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0039-1 Rating: moderate References: #1119063 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xfsprogs fixes the following issues: - Fix root inode's parent when it's bogus for sf directory (xfs repair). (bsc#1119063) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-39=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): xfsprogs-4.15.0-lp150.3.7.1 xfsprogs-debuginfo-4.15.0-lp150.3.7.1 xfsprogs-debugsource-4.15.0-lp150.3.7.1 xfsprogs-devel-4.15.0-lp150.3.7.1 References: https://bugzilla.suse.com/1119063

1 0

openSUSE-SU-2019:0043-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0043-1 Rating: important References: #1112142 #1112143 #1112144 #1112146 #1112147 #1112148 #1112152 #1112153 Cross-References: CVE-2018-13785 CVE-2018-16435 CVE-2018-3136 CVE-2018-3139 CVE-2018-3149 CVE-2018-3169 CVE-2018-3180 CVE-2018-3183 CVE-2018-3214 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk to version 8u191 fixes the following issues: Security issues fixed: - CVE-2018-3136: Manifest better support (bsc#1112142) - CVE-2018-3139: Better HTTP Redirection (bsc#1112143) - CVE-2018-3149: Enhance JNDI lookups (bsc#1112144) - CVE-2018-3169: Improve field accesses (bsc#1112146) - CVE-2018-3180: Improve TLS connections stability (bsc#1112147) - CVE-2018-3214: Better RIFF reading support (bsc#1112152) - CVE-2018-13785: Upgrade JDK 8u to libpng 1.6.35 (bsc#1112153) - CVE-2018-3183: Improve script engine support (bsc#1112148) - CVE-2018-16435: heap-based buffer overflow in SetData function in cmsIT8LoadFromFile This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-43=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-43=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_8_0-openjdk-1.8.0.191-30.1 java-1_8_0-openjdk-accessibility-1.8.0.191-30.1 java-1_8_0-openjdk-debuginfo-1.8.0.191-30.1 java-1_8_0-openjdk-debugsource-1.8.0.191-30.1 java-1_8_0-openjdk-demo-1.8.0.191-30.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.191-30.1 java-1_8_0-openjdk-devel-1.8.0.191-30.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.191-30.1 java-1_8_0-openjdk-headless-1.8.0.191-30.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.191-30.1 java-1_8_0-openjdk-src-1.8.0.191-30.1 - openSUSE Leap 42.3 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.191-30.1 - openSUSE Leap 15.0 (i586 x86_64): java-1_8_0-openjdk-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-accessibility-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-debuginfo-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-debugsource-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-demo-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-demo-debuginfo-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-devel-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-devel-debuginfo-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-headless-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-headless-debuginfo-1.8.0.191-lp150.2.9.2 java-1_8_0-openjdk-src-1.8.0.191-lp150.2.9.2 - openSUSE Leap 15.0 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.191-lp150.2.9.2 References: https://www.suse.com/security/cve/CVE-2018-13785.html https://www.suse.com/security/cve/CVE-2018-16435.html https://www.suse.com/security/cve/CVE-2018-3136.html https://www.suse.com/security/cve/CVE-2018-3139.html https://www.suse.com/security/cve/CVE-2018-3149.html https://www.suse.com/security/cve/CVE-2018-3169.html https://www.suse.com/security/cve/CVE-2018-3180.html https://www.suse.com/security/cve/CVE-2018-3183.html https://www.suse.com/security/cve/CVE-2018-3214.html https://bugzilla.suse.com/1112142 https://bugzilla.suse.com/1112143 https://bugzilla.suse.com/1112144 https://bugzilla.suse.com/1112146 https://bugzilla.suse.com/1112147 https://bugzilla.suse.com/1112148 https://bugzilla.suse.com/1112152 https://bugzilla.suse.com/1112153

1 0

openSUSE-SU-2019:0019-1: moderate: Security update for discount
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for discount ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0019-1 Rating: moderate References: #1094809 #1098252 Cross-References: CVE-2018-11468 CVE-2018-12495 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for discount to version 2.2.4 fixes the following issues: Security issues fixed: - CVE-2018-11468: Fixed a heap-based buffer over-read in the __mkd_trim_line function from mkdio.c (boo#1094809) - CVE-2018-12495: Fixed a heap-based buffer over-read via a crafted file (boo#1098252) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-19=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-19=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-19=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): discount-2.2.4-7.3.1 discount-debugsource-2.2.4-7.3.1 libmarkdown-devel-2.2.4-7.3.1 libmarkdown2-2.2.4-7.3.1 libmarkdown2-debuginfo-2.2.4-7.3.1 - openSUSE Leap 15.0 (x86_64): discount-2.2.4-lp150.2.3.1 discount-debugsource-2.2.4-lp150.2.3.1 libmarkdown-devel-2.2.4-lp150.2.3.1 libmarkdown2-2.2.4-lp150.2.3.1 libmarkdown2-debuginfo-2.2.4-lp150.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): discount-2.2.4-bp150.3.3.1 libmarkdown-devel-2.2.4-bp150.3.3.1 libmarkdown2-2.2.4-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-11468.html https://www.suse.com/security/cve/CVE-2018-12495.html https://bugzilla.suse.com/1094809 https://bugzilla.suse.com/1098252

1 0

openSUSE-SU-2019:0021-1: important: Security update for libgit2
by opensuse-security＠opensuse.org 12 Jan '19

12 Jan '19

openSUSE Security Update: Security update for libgit2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0021-1 Rating: important References: #1110949 #1114729 Cross-References: CVE-2018-19456 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for libgit2 fixes the following issues: Security issues fixed: - CVE-2018-19456: Fixed a code execution by malicious .gitmodules file (bsc#1110949) - various string-to-integer and buffer handling fixes (bsc#1114729). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-21=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libgit2-24-0.24.1-10.6.1 libgit2-24-debuginfo-0.24.1-10.6.1 libgit2-debugsource-0.24.1-10.6.1 libgit2-devel-0.24.1-10.6.1 - openSUSE Leap 42.3 (x86_64): libgit2-24-32bit-0.24.1-10.6.1 libgit2-24-debuginfo-32bit-0.24.1-10.6.1 References: https://www.suse.com/security/cve/CVE-2018-19456.html https://bugzilla.suse.com/1110949 https://bugzilla.suse.com/1114729

1 0

openSUSE-SU-2019:0016-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 11 Jan '19

11 Jan '19

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0016-1 Rating: moderate References: #1120381 Cross-References: CVE-2018-20467 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issue: Security issue fixed: - CVE-2018-20467: Fixed infinite loop in coders/bmp.c (boo#1120381) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-16=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-123.1 GraphicsMagick-debuginfo-1.3.25-123.1 GraphicsMagick-debugsource-1.3.25-123.1 GraphicsMagick-devel-1.3.25-123.1 libGraphicsMagick++-Q16-12-1.3.25-123.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-123.1 libGraphicsMagick++-devel-1.3.25-123.1 libGraphicsMagick-Q16-3-1.3.25-123.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-123.1 libGraphicsMagick3-config-1.3.25-123.1 libGraphicsMagickWand-Q16-2-1.3.25-123.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-123.1 perl-GraphicsMagick-1.3.25-123.1 perl-GraphicsMagick-debuginfo-1.3.25-123.1 References: https://www.suse.com/security/cve/CVE-2018-20467.html https://bugzilla.suse.com/1120381

1 0

openSUSE-RU-2019:0014-1: moderate: Recommended update for mirror
by maintenance＠opensuse.org 11 Jan '19

11 Jan '19

openSUSE Recommended Update: Recommended update for mirror ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0014-1 Rating: moderate References: #1117110 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mirror provides the following fix: - Check if a directory must be removed. In case all the previous content of a directory is removed, but new content for the directory was downloaded, do not remove it. (bsc#1117110) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-14=1 Package List: - openSUSE Leap 15.0 (noarch): mirror-2.9-lp150.2.3.1 References: https://bugzilla.suse.com/1117110

1 0

openSUSE-RU-2019:0013-1: moderate: Recommended update for python-rtslib
by maintenance＠opensuse.org 11 Jan '19

11 Jan '19

openSUSE Recommended Update: Recommended update for python-rtslib ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0013-1 Rating: moderate References: #1113573 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-rtslib provides the following fix: - Add srpt_wwn WWN type handling. (bsc#1113573) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-13=1 Package List: - openSUSE Leap 42.3 (noarch): python-rtslib-2.2-19.6.1 References: https://bugzilla.suse.com/1113573

1 0

openSUSE-RU-2019:0011-1: moderate: Recommended update for OpenIPMI
by maintenance＠opensuse.org 11 Jan '19

11 Jan '19

openSUSE Recommended Update: Recommended update for OpenIPMI ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0011-1 Rating: moderate References: #1060799 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for OpenIPMI provides the following fix: - On aarch64 hardware, the IPMI hardware was detected but an incorrect driver was loaded ("ipmi_si.ko" rather than the correct "ipmi_ssif.ko"). The fix adds a new entry to /etc/sysconfig/ipmi which defines the name of the driver to load. A utility (/usr/lib/openipmi-helper) then uses this name to load the correct driveri. (bsc#1060799) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-11=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): OpenIPMI-2.0.21-14.1 OpenIPMI-debuginfo-2.0.21-14.1 OpenIPMI-debugsource-2.0.21-14.1 OpenIPMI-devel-2.0.21-14.1 OpenIPMI-python-2.0.21-14.1 OpenIPMI-python-debuginfo-2.0.21-14.1 References: https://bugzilla.suse.com/1060799

1 0

openSUSE-RU-2019:0012-1: moderate: Recommended update for mirror
by maintenance＠opensuse.org 11 Jan '19

11 Jan '19

openSUSE Recommended Update: Recommended update for mirror ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0012-1 Rating: moderate References: #1117110 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mirror provides the following fix: - Check if a directory must be removed. In case all the previous content of a directory is removed, but new content for the directory was downloaded, do not remove it. (bsc#1117110) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-12=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): mirror-2.9-914.3.1 References: https://bugzilla.suse.com/1117110

1 0

openSUSE-SU-2019:0010-1: moderate: Security update for polkit
by opensuse-security＠opensuse.org 10 Jan '19

10 Jan '19

openSUSE Security Update: Security update for polkit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0010-1 Rating: moderate References: #1118277 Cross-References: CVE-2018-19788 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for polkit fixes the following issues: Security issue fixed: - CVE-2018-19788: Fixed handling of UIDs over MAX_UINT (bsc#1118277) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-10=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libpolkit0-0.114-lp150.2.6.1 libpolkit0-debuginfo-0.114-lp150.2.6.1 polkit-0.114-lp150.2.6.1 polkit-debuginfo-0.114-lp150.2.6.1 polkit-debugsource-0.114-lp150.2.6.1 polkit-devel-0.114-lp150.2.6.1 polkit-devel-debuginfo-0.114-lp150.2.6.1 typelib-1_0-Polkit-1_0-0.114-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libpolkit0-32bit-0.114-lp150.2.6.1 libpolkit0-32bit-debuginfo-0.114-lp150.2.6.1 - openSUSE Leap 15.0 (noarch): polkit-doc-0.114-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-19788.html https://bugzilla.suse.com/1118277

1 0

openSUSE-SU-2019:0008-1: moderate: Security update for libraw
by opensuse-security＠opensuse.org 10 Jan '19

10 Jan '19

openSUSE Security Update: Security update for libraw ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0008-1 Rating: moderate References: #1097975 #1103200 #1103206 Cross-References: CVE-2018-5804 CVE-2018-5813 CVE-2018-5815 CVE-2018-5816 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libraw fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-5813: Fixed an error within the "parse_minolta()" function (dcraw/dcraw.c) that could be exploited to trigger an infinite loop via a specially crafted file. This could be exploited to cause a DoS.(boo#1103200). - CVE-2018-5815: Fixed an integer overflow in the internal/dcraw_common.cpp:parse_qt() function, that could be exploited to cause an infinite loop via a specially crafted Apple QuickTime file. (boo#1103206) - CVE-2018-5804,CVE-2018-5816: Fixed a type confusion error in the identify function (bsc#1097975) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-8=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libraw-debuginfo-0.18.9-lp150.2.3.1 libraw-debugsource-0.18.9-lp150.2.3.1 libraw-devel-0.18.9-lp150.2.3.1 libraw-devel-static-0.18.9-lp150.2.3.1 libraw-tools-0.18.9-lp150.2.3.1 libraw-tools-debuginfo-0.18.9-lp150.2.3.1 libraw16-0.18.9-lp150.2.3.1 libraw16-debuginfo-0.18.9-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-5804.html https://www.suse.com/security/cve/CVE-2018-5813.html https://www.suse.com/security/cve/CVE-2018-5815.html https://www.suse.com/security/cve/CVE-2018-5816.html https://bugzilla.suse.com/1097975 https://bugzilla.suse.com/1103200 https://bugzilla.suse.com/1103206

1 0