October 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2019:2289-1: moderate: Recommended update for charliecloud
by maintenance＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Recommended Update: Recommended update for charliecloud ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2289-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for charliecloud fixes the following issues: charliecloud was updated to version 0.11: - ch-run: /etc/resolv.conf on the host is now optional - ch-grow: support ARG instruction - build now does not infinite loop if no Python installed - miscellaneous bug fixes, and documentation and test suite improvements Update to version 0.10: - New builder ch-grow - ch-build includes option --builder - ch-docker2tar renamed to ch-builder2tar - new quashFS wrapper scripts: ch-docker2squash, ch-docker2squash, ch-tar2squash, ch-mount and ch-umount - new namespace tester ch-checkns - Full changelog at https://groups.io/g/charliecloud/message/96 Update to version 0.9.10: - Documentation and examples: misc improvements. - Full changelog at https://groups.io/g/charliecloud/message/88 Update to version 0.9.9: - Bugfixes and documentation improvements. - Full changelog at https://groups.io/g/charliecloud/message/87 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2289=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2289=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-2289=1 Package List: - openSUSE Leap 15.1 (x86_64): charliecloud-0.11-lp151.2.3.1 charliecloud-debuginfo-0.11-lp151.2.3.1 charliecloud-debugsource-0.11-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): charliecloud-doc-0.11-lp151.2.3.1 charliecloud-examples-0.11-lp151.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): charliecloud-0.11-bp150.5.1 charliecloud-debuginfo-0.11-bp150.5.1 charliecloud-debugsource-0.11-bp150.5.1 - openSUSE Backports SLE-15 (noarch): charliecloud-doc-0.11-bp150.5.1 charliecloud-examples-0.11-bp150.5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): charliecloud-0.11-7.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (ppc64le): charliecloud-debuginfo-0.11-7.1 charliecloud-debugsource-0.11-7.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): charliecloud-examples-0.11-7.1 References:

1 0

openSUSE-SU-2019:2280-1: moderate: Security update for libseccomp
by opensuse-security＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Security Update: Security update for libseccomp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2280-1 Rating: moderate References: #1082318 #1128828 #1142614 Cross-References: CVE-2019-9893 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for libseccomp fixes the following issues: Security issues fixed: - CVE-2019-9893: An incorrect generation of syscall filters in libseccomp was fixed (bsc#1128828) libseccomp was updated to new upstream release 2.4.1: - Fix a BPF generation bug where the optimizer mistakenly identified duplicate BPF code blocks. libseccomp was updated to 2.4.0 (bsc#1128828 CVE-2019-9893): - Update the syscall table for Linux v5.0-rc5 - Added support for the SCMP_ACT_KILL_PROCESS action - Added support for the SCMP_ACT_LOG action and SCMP_FLTATR_CTL_LOG attribute - Added explicit 32-bit (SCMP_AX_32(...)) and 64-bit (SCMP_AX_64(...)) argument comparison macros to help protect against unexpected sign extension - Added support for the parisc and parisc64 architectures - Added the ability to query and set the libseccomp API level via seccomp_api_get(3) and seccomp_api_set(3) - Return -EDOM on an endian mismatch when adding an architecture to a filter - Renumber the pseudo syscall number for subpage_prot() so it no longer conflicts with spu_run() - Fix PFC generation when a syscall is prioritized, but no rule exists - Numerous fixes to the seccomp-bpf filter generation code - Switch our internal hashing function to jhash/Lookup3 to MurmurHash3 - Numerous tests added to the included test suite, coverage now at ~92% - Update our Travis CI configuration to use Ubuntu 16.04 - Numerous documentation fixes and updates libseccomp was updated to release 2.3.3: - Updated the syscall table for Linux v4.15-rc7 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2280=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libseccomp-debugsource-2.4.1-lp150.2.3.1 libseccomp-devel-2.4.1-lp150.2.3.1 libseccomp-tools-2.4.1-lp150.2.3.1 libseccomp-tools-debuginfo-2.4.1-lp150.2.3.1 libseccomp2-2.4.1-lp150.2.3.1 libseccomp2-debuginfo-2.4.1-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libseccomp2-32bit-2.4.1-lp150.2.3.1 libseccomp2-32bit-debuginfo-2.4.1-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-9893.html https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1128828 https://bugzilla.suse.com/1142614

1 0

openSUSE-SU-2019:2281-1: important: Security update for dovecot23
by opensuse-security＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Security Update: Security update for dovecot23 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2281-1 Rating: important References: #1133624 #1133625 #1145559 Cross-References: CVE-2019-11494 CVE-2019-11499 CVE-2019-11500 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for dovecot23 fixes the following issues: - CVE-2019-11500: Fixed the NUL byte handling in IMAP and ManageSieve protocol parsers. (bsc#1145559) - CVE-2019-11499: Fixed a vulnerability where the submission-login would crash over a TLS secured channel (bsc#1133625). - CVE-2019-11494: Fixed a denial of service if the authentication is aborted by disconnecting (bsc#1133624). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2281=1 Package List: - openSUSE Leap 15.1 (x86_64): dovecot23-2.3.3-lp151.2.6.1 dovecot23-backend-mysql-2.3.3-lp151.2.6.1 dovecot23-backend-mysql-debuginfo-2.3.3-lp151.2.6.1 dovecot23-backend-pgsql-2.3.3-lp151.2.6.1 dovecot23-backend-pgsql-debuginfo-2.3.3-lp151.2.6.1 dovecot23-backend-sqlite-2.3.3-lp151.2.6.1 dovecot23-backend-sqlite-debuginfo-2.3.3-lp151.2.6.1 dovecot23-debuginfo-2.3.3-lp151.2.6.1 dovecot23-debugsource-2.3.3-lp151.2.6.1 dovecot23-devel-2.3.3-lp151.2.6.1 dovecot23-fts-2.3.3-lp151.2.6.1 dovecot23-fts-debuginfo-2.3.3-lp151.2.6.1 dovecot23-fts-lucene-2.3.3-lp151.2.6.1 dovecot23-fts-lucene-debuginfo-2.3.3-lp151.2.6.1 dovecot23-fts-solr-2.3.3-lp151.2.6.1 dovecot23-fts-solr-debuginfo-2.3.3-lp151.2.6.1 dovecot23-fts-squat-2.3.3-lp151.2.6.1 dovecot23-fts-squat-debuginfo-2.3.3-lp151.2.6.1 References: https://www.suse.com/security/cve/CVE-2019-11494.html https://www.suse.com/security/cve/CVE-2019-11499.html https://www.suse.com/security/cve/CVE-2019-11500.html https://bugzilla.suse.com/1133624 https://bugzilla.suse.com/1133625 https://bugzilla.suse.com/1145559

1 0

openSUSE-SU-2019:2279-1: moderate: Security update for jasper
by opensuse-security＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Security Update: Security update for jasper ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2279-1 Rating: moderate References: #1117507 #1117508 Cross-References: CVE-2018-19540 CVE-2018-19541 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for jasper fixes the following issues: Security issues fixed: - CVE-2018-19540: Fixed a heap based overflow in jas_icctxtdesc_input (bsc#1117508). - CVE-2018-19541: Fix heap based overread in jas_image_depalettize (bsc#1117507). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2279=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): jasper-2.0.14-lp150.2.6.1 jasper-debuginfo-2.0.14-lp150.2.6.1 jasper-debugsource-2.0.14-lp150.2.6.1 libjasper-devel-2.0.14-lp150.2.6.1 libjasper4-2.0.14-lp150.2.6.1 libjasper4-debuginfo-2.0.14-lp150.2.6.1 - openSUSE Leap 15.0 (x86_64): libjasper4-32bit-2.0.14-lp150.2.6.1 libjasper4-32bit-debuginfo-2.0.14-lp150.2.6.1 References: https://www.suse.com/security/cve/CVE-2018-19540.html https://www.suse.com/security/cve/CVE-2018-19541.html https://bugzilla.suse.com/1117507 https://bugzilla.suse.com/1117508

1 0

openSUSE-SU-2019:2278-1: important: Security update for dovecot23
by opensuse-security＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Security Update: Security update for dovecot23 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2278-1 Rating: important References: #1133624 #1133625 #1145559 Cross-References: CVE-2019-11494 CVE-2019-11499 CVE-2019-11500 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for dovecot23 fixes the following issue: - CVE-2019-11500: Fixed the NUL byte handling in IMAP and ManageSieve protocol parsers. (bsc#1145559) - CVE-2019-11499: Fixed a vulnerability where the submission-login would crash over a TLS secured channel (bsc#1133625). - CVE-2019-11494: Fixed a denial of service if the authentication is aborted by disconnecting (bsc#1133624). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2278=1 Package List: - openSUSE Leap 15.0 (x86_64): dovecot23-2.3.3-lp150.14.1 dovecot23-backend-mysql-2.3.3-lp150.14.1 dovecot23-backend-mysql-debuginfo-2.3.3-lp150.14.1 dovecot23-backend-pgsql-2.3.3-lp150.14.1 dovecot23-backend-pgsql-debuginfo-2.3.3-lp150.14.1 dovecot23-backend-sqlite-2.3.3-lp150.14.1 dovecot23-backend-sqlite-debuginfo-2.3.3-lp150.14.1 dovecot23-debuginfo-2.3.3-lp150.14.1 dovecot23-debugsource-2.3.3-lp150.14.1 dovecot23-devel-2.3.3-lp150.14.1 dovecot23-fts-2.3.3-lp150.14.1 dovecot23-fts-debuginfo-2.3.3-lp150.14.1 dovecot23-fts-lucene-2.3.3-lp150.14.1 dovecot23-fts-lucene-debuginfo-2.3.3-lp150.14.1 dovecot23-fts-solr-2.3.3-lp150.14.1 dovecot23-fts-solr-debuginfo-2.3.3-lp150.14.1 dovecot23-fts-squat-2.3.3-lp150.14.1 dovecot23-fts-squat-debuginfo-2.3.3-lp150.14.1 References: https://www.suse.com/security/cve/CVE-2019-11494.html https://www.suse.com/security/cve/CVE-2019-11499.html https://www.suse.com/security/cve/CVE-2019-11500.html https://bugzilla.suse.com/1133624 https://bugzilla.suse.com/1133625 https://bugzilla.suse.com/1145559

1 0

openSUSE-RU-2019:2289-1: moderate: Recommended update for charliecloud
by maintenance＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Recommended Update: Recommended update for charliecloud ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2289-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for charliecloud fixes the following issues: charliecloud was updated to version 0.11: - ch-run: /etc/resolv.conf on the host is now optional - ch-grow: support ARG instruction - build now does not infinite loop if no Python installed - miscellaneous bug fixes, and documentation and test suite improvements Update to version 0.10: - New builder ch-grow - ch-build includes option --builder - ch-docker2tar renamed to ch-builder2tar - new quashFS wrapper scripts: ch-docker2squash, ch-docker2squash, ch-tar2squash, ch-mount and ch-umount - new namespace tester ch-checkns - Full changelog at https://groups.io/g/charliecloud/message/96 Update to version 0.9.10: - Documentation and examples: misc improvements. - Full changelog at https://groups.io/g/charliecloud/message/88 Update to version 0.9.9: - Bugfixes and documentation improvements. - Full changelog at https://groups.io/g/charliecloud/message/87 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2289=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2289=1 Package List: - openSUSE Leap 15.1 (x86_64): charliecloud-0.11-lp151.2.3.1 charliecloud-debuginfo-0.11-lp151.2.3.1 charliecloud-debugsource-0.11-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): charliecloud-doc-0.11-lp151.2.3.1 charliecloud-examples-0.11-lp151.2.3.1 - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): charliecloud-0.11-bp150.5.1 charliecloud-debuginfo-0.11-bp150.5.1 charliecloud-debugsource-0.11-bp150.5.1 - openSUSE Backports SLE-15 (noarch): charliecloud-doc-0.11-bp150.5.1 charliecloud-examples-0.11-bp150.5.1 References:

1 0

openSUSE-RU-2019:2285-1: moderate: Recommended update for python-python-daemon
by maintenance＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Recommended Update: Recommended update for python-python-daemon ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2285-1 Rating: moderate References: #1150145 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-python-daemon fixes the following issues: - Do not pull in docutils on runtime, bsc#1150145 This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2285=1 Package List: - openSUSE Backports SLE-15 (noarch): python2-python-daemon-2.1.2-bp150.2.3.1 python3-python-daemon-2.1.2-bp150.2.3.1 References: https://bugzilla.suse.com/1150145

1 0

openSUSE-SU-2019:2282-1: moderate: Security update for jasper
by opensuse-security＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Security Update: Security update for jasper ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2282-1 Rating: moderate References: #1117507 #1117508 Cross-References: CVE-2018-19540 CVE-2018-19541 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for jasper fixes the following issues: Security issues fixed: - CVE-2018-19540: Fixed a heap based overflow in jas_icctxtdesc_input (bsc#1117508). - CVE-2018-19541: Fix heap based overread in jas_image_depalettize (bsc#1117507). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2282=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): jasper-2.0.14-lp151.4.3.1 jasper-debuginfo-2.0.14-lp151.4.3.1 jasper-debugsource-2.0.14-lp151.4.3.1 libjasper-devel-2.0.14-lp151.4.3.1 libjasper4-2.0.14-lp151.4.3.1 libjasper4-debuginfo-2.0.14-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): libjasper4-32bit-2.0.14-lp151.4.3.1 libjasper4-32bit-debuginfo-2.0.14-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-19540.html https://www.suse.com/security/cve/CVE-2018-19541.html https://bugzilla.suse.com/1117507 https://bugzilla.suse.com/1117508

1 0

openSUSE-SU-2019:2283-1: moderate: Security update for libseccomp
by opensuse-security＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Security Update: Security update for libseccomp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2283-1 Rating: moderate References: #1082318 #1128828 #1142614 Cross-References: CVE-2019-9893 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for libseccomp fixes the following issues: Security issues fixed: - CVE-2019-9893: An incorrect generation of syscall filters in libseccomp was fixed (bsc#1128828) libseccomp was updated to new upstream release 2.4.1: - Fix a BPF generation bug where the optimizer mistakenly identified duplicate BPF code blocks. libseccomp was updated to 2.4.0 (bsc#1128828 CVE-2019-9893): - Update the syscall table for Linux v5.0-rc5 - Added support for the SCMP_ACT_KILL_PROCESS action - Added support for the SCMP_ACT_LOG action and SCMP_FLTATR_CTL_LOG attribute - Added explicit 32-bit (SCMP_AX_32(...)) and 64-bit (SCMP_AX_64(...)) argument comparison macros to help protect against unexpected sign extension - Added support for the parisc and parisc64 architectures - Added the ability to query and set the libseccomp API level via seccomp_api_get(3) and seccomp_api_set(3) - Return -EDOM on an endian mismatch when adding an architecture to a filter - Renumber the pseudo syscall number for subpage_prot() so it no longer conflicts with spu_run() - Fix PFC generation when a syscall is prioritized, but no rule exists - Numerous fixes to the seccomp-bpf filter generation code - Switch our internal hashing function to jhash/Lookup3 to MurmurHash3 - Numerous tests added to the included test suite, coverage now at ~92% - Update our Travis CI configuration to use Ubuntu 16.04 - Numerous documentation fixes and updates libseccomp was updated to release 2.3.3: - Updated the syscall table for Linux v4.15-rc7 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2283=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libseccomp-debugsource-2.4.1-lp151.3.3.1 libseccomp-devel-2.4.1-lp151.3.3.1 libseccomp-tools-2.4.1-lp151.3.3.1 libseccomp-tools-debuginfo-2.4.1-lp151.3.3.1 libseccomp2-2.4.1-lp151.3.3.1 libseccomp2-debuginfo-2.4.1-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libseccomp2-32bit-2.4.1-lp151.3.3.1 libseccomp2-32bit-debuginfo-2.4.1-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-9893.html https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1128828 https://bugzilla.suse.com/1142614

1 0

openSUSE-SU-2019:2276-1: moderate: Security update for putty
by opensuse-security＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Security Update: Security update for putty ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2276-1 Rating: moderate References: #1152753 Cross-References: CVE-2019-17068 CVE-2019-17069 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for putty to version 0.73 fixes the following issues: Security issues fixed: - CVE-2019-17068: Fixed the insufficient handling of terminal escape sequences, that should delimit the pasted data in bracketed paste mode (boo#1152753). - CVE-2019-17069: Fixed a possible information leak caused by SSH-1 disconnection messages (boo#1152753). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2276=1 Package List: - openSUSE Leap 15.0 (x86_64): putty-0.73-lp150.18.1 putty-debuginfo-0.73-lp150.18.1 putty-debugsource-0.73-lp150.18.1 References: https://www.suse.com/security/cve/CVE-2019-17068.html https://www.suse.com/security/cve/CVE-2019-17069.html https://bugzilla.suse.com/1152753

1 0