October 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:2277-1: moderate: Security update for putty
by opensuse-security＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Security Update: Security update for putty ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2277-1 Rating: moderate References: #1152753 Cross-References: CVE-2019-17068 CVE-2019-17069 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for putty to version 0.73 fixes the following issues: - CVE-2019-17068: Fixed the insufficient handling of terminal escape sequences, that should delimit the pasted data in bracketed paste mode (boo#1152753). - CVE-2019-17069: Fixed a possible information leak caused by SSH-1 disconnection messages (boo#1152753). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2277=1 Package List: - openSUSE Leap 15.1 (x86_64): putty-0.73-lp151.3.6.1 putty-debuginfo-0.73-lp151.3.6.1 putty-debugsource-0.73-lp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-17068.html https://www.suse.com/security/cve/CVE-2019-17069.html https://bugzilla.suse.com/1152753

1 0

openSUSE-RU-2019:2273-1: moderate: Recommended update for spec-cleaner
by maintenance＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Recommended Update: Recommended update for spec-cleaner ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2273-1 Rating: moderate References: #1099674 Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for spec-cleaner fixes the following issues: Version update to 1.1.5 (boo#1099674): * Use https in URL in spec-cleaner.spec test * Remove duplicated backslash in regexp * Parallelize test run * Add jupyter_move_config to excludes from bracketing * Do not fail if URL is ftp:// or other protocol * Make xdist enabled by default on all test runs and add xdist to deps * By default remove groups from packages This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2273=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2273=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): spec-cleaner-1.1.5-bp151.3.6.1 spec-cleaner-format_spec_file-1.1.5-bp151.3.6.1 - openSUSE Backports SLE-15 (noarch): spec-cleaner-1.1.5-bp150.67.1 spec-cleaner-format_spec_file-1.1.5-bp150.67.1 References: https://bugzilla.suse.com/1099674

1 0

openSUSE-RU-2019:2275-1: moderate: Recommended update for python-python-daemon
by maintenance＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Recommended Update: Recommended update for python-python-daemon ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2275-1 Rating: moderate References: #1150145 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-python-daemon fixes the following issues: - Do not pull in docutils on runtime, bsc#1150145 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2275=1 Package List: - openSUSE Leap 15.1 (noarch): python2-python-daemon-2.1.2-lp151.3.3.1 python3-python-daemon-2.1.2-lp151.3.3.1 References: https://bugzilla.suse.com/1150145

1 0

openSUSE-RU-2019:2274-1: moderate: Recommended update for python-python-daemon
by maintenance＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Recommended Update: Recommended update for python-python-daemon ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2274-1 Rating: moderate References: #1150145 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-python-daemon fixes the following issues: - Do not pull in docutils on runtime, bsc#1150145 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2274=1 Package List: - openSUSE Leap 15.0 (noarch): python2-python-daemon-2.1.2-lp150.2.3.1 python3-python-daemon-2.1.2-lp150.2.3.1 References: https://bugzilla.suse.com/1150145

1 0

openSUSE-SU-2019:2271-1: important: Security update for php7
by opensuse-security＠opensuse.org 07 Oct '19

07 Oct '19

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2271-1 Rating: important References: #1145095 #1146360 #1151793 Cross-References: CVE-2019-11041 CVE-2019-11042 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for php7 fixes the following issues: Security issues fixed: - CVE-2019-11041: Fixed heap buffer over-read in exif_scan_thumbnail() (bsc#1146360). - CVE-2019-11042: Fixed heap buffer over-read in exif_process_user_comment() (bsc#1145095). Non-security issue fixed: - Drop -n from php invocation from pecl (bsc#1151793). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2271=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): apache2-mod_php7-7.2.5-lp150.2.25.1 apache2-mod_php7-debuginfo-7.2.5-lp150.2.25.1 php7-7.2.5-lp150.2.25.1 php7-bcmath-7.2.5-lp150.2.25.1 php7-bcmath-debuginfo-7.2.5-lp150.2.25.1 php7-bz2-7.2.5-lp150.2.25.1 php7-bz2-debuginfo-7.2.5-lp150.2.25.1 php7-calendar-7.2.5-lp150.2.25.1 php7-calendar-debuginfo-7.2.5-lp150.2.25.1 php7-ctype-7.2.5-lp150.2.25.1 php7-ctype-debuginfo-7.2.5-lp150.2.25.1 php7-curl-7.2.5-lp150.2.25.1 php7-curl-debuginfo-7.2.5-lp150.2.25.1 php7-dba-7.2.5-lp150.2.25.1 php7-dba-debuginfo-7.2.5-lp150.2.25.1 php7-debuginfo-7.2.5-lp150.2.25.1 php7-debugsource-7.2.5-lp150.2.25.1 php7-devel-7.2.5-lp150.2.25.1 php7-dom-7.2.5-lp150.2.25.1 php7-dom-debuginfo-7.2.5-lp150.2.25.1 php7-embed-7.2.5-lp150.2.25.1 php7-embed-debuginfo-7.2.5-lp150.2.25.1 php7-enchant-7.2.5-lp150.2.25.1 php7-enchant-debuginfo-7.2.5-lp150.2.25.1 php7-exif-7.2.5-lp150.2.25.1 php7-exif-debuginfo-7.2.5-lp150.2.25.1 php7-fastcgi-7.2.5-lp150.2.25.1 php7-fastcgi-debuginfo-7.2.5-lp150.2.25.1 php7-fileinfo-7.2.5-lp150.2.25.1 php7-fileinfo-debuginfo-7.2.5-lp150.2.25.1 php7-firebird-7.2.5-lp150.2.25.1 php7-firebird-debuginfo-7.2.5-lp150.2.25.1 php7-fpm-7.2.5-lp150.2.25.1 php7-fpm-debuginfo-7.2.5-lp150.2.25.1 php7-ftp-7.2.5-lp150.2.25.1 php7-ftp-debuginfo-7.2.5-lp150.2.25.1 php7-gd-7.2.5-lp150.2.25.1 php7-gd-debuginfo-7.2.5-lp150.2.25.1 php7-gettext-7.2.5-lp150.2.25.1 php7-gettext-debuginfo-7.2.5-lp150.2.25.1 php7-gmp-7.2.5-lp150.2.25.1 php7-gmp-debuginfo-7.2.5-lp150.2.25.1 php7-iconv-7.2.5-lp150.2.25.1 php7-iconv-debuginfo-7.2.5-lp150.2.25.1 php7-intl-7.2.5-lp150.2.25.1 php7-intl-debuginfo-7.2.5-lp150.2.25.1 php7-json-7.2.5-lp150.2.25.1 php7-json-debuginfo-7.2.5-lp150.2.25.1 php7-ldap-7.2.5-lp150.2.25.1 php7-ldap-debuginfo-7.2.5-lp150.2.25.1 php7-mbstring-7.2.5-lp150.2.25.1 php7-mbstring-debuginfo-7.2.5-lp150.2.25.1 php7-mysql-7.2.5-lp150.2.25.1 php7-mysql-debuginfo-7.2.5-lp150.2.25.1 php7-odbc-7.2.5-lp150.2.25.1 php7-odbc-debuginfo-7.2.5-lp150.2.25.1 php7-opcache-7.2.5-lp150.2.25.1 php7-opcache-debuginfo-7.2.5-lp150.2.25.1 php7-openssl-7.2.5-lp150.2.25.1 php7-openssl-debuginfo-7.2.5-lp150.2.25.1 php7-pcntl-7.2.5-lp150.2.25.1 php7-pcntl-debuginfo-7.2.5-lp150.2.25.1 php7-pdo-7.2.5-lp150.2.25.1 php7-pdo-debuginfo-7.2.5-lp150.2.25.1 php7-pgsql-7.2.5-lp150.2.25.1 php7-pgsql-debuginfo-7.2.5-lp150.2.25.1 php7-phar-7.2.5-lp150.2.25.1 php7-phar-debuginfo-7.2.5-lp150.2.25.1 php7-posix-7.2.5-lp150.2.25.1 php7-posix-debuginfo-7.2.5-lp150.2.25.1 php7-readline-7.2.5-lp150.2.25.1 php7-readline-debuginfo-7.2.5-lp150.2.25.1 php7-shmop-7.2.5-lp150.2.25.1 php7-shmop-debuginfo-7.2.5-lp150.2.25.1 php7-snmp-7.2.5-lp150.2.25.1 php7-snmp-debuginfo-7.2.5-lp150.2.25.1 php7-soap-7.2.5-lp150.2.25.1 php7-soap-debuginfo-7.2.5-lp150.2.25.1 php7-sockets-7.2.5-lp150.2.25.1 php7-sockets-debuginfo-7.2.5-lp150.2.25.1 php7-sodium-7.2.5-lp150.2.25.1 php7-sodium-debuginfo-7.2.5-lp150.2.25.1 php7-sqlite-7.2.5-lp150.2.25.1 php7-sqlite-debuginfo-7.2.5-lp150.2.25.1 php7-sysvmsg-7.2.5-lp150.2.25.1 php7-sysvmsg-debuginfo-7.2.5-lp150.2.25.1 php7-sysvsem-7.2.5-lp150.2.25.1 php7-sysvsem-debuginfo-7.2.5-lp150.2.25.1 php7-sysvshm-7.2.5-lp150.2.25.1 php7-sysvshm-debuginfo-7.2.5-lp150.2.25.1 php7-tidy-7.2.5-lp150.2.25.1 php7-tidy-debuginfo-7.2.5-lp150.2.25.1 php7-tokenizer-7.2.5-lp150.2.25.1 php7-tokenizer-debuginfo-7.2.5-lp150.2.25.1 php7-wddx-7.2.5-lp150.2.25.1 php7-wddx-debuginfo-7.2.5-lp150.2.25.1 php7-xmlreader-7.2.5-lp150.2.25.1 php7-xmlreader-debuginfo-7.2.5-lp150.2.25.1 php7-xmlrpc-7.2.5-lp150.2.25.1 php7-xmlrpc-debuginfo-7.2.5-lp150.2.25.1 php7-xmlwriter-7.2.5-lp150.2.25.1 php7-xmlwriter-debuginfo-7.2.5-lp150.2.25.1 php7-xsl-7.2.5-lp150.2.25.1 php7-xsl-debuginfo-7.2.5-lp150.2.25.1 php7-zip-7.2.5-lp150.2.25.1 php7-zip-debuginfo-7.2.5-lp150.2.25.1 php7-zlib-7.2.5-lp150.2.25.1 php7-zlib-debuginfo-7.2.5-lp150.2.25.1 - openSUSE Leap 15.0 (noarch): php7-pear-7.2.5-lp150.2.25.1 php7-pear-Archive_Tar-7.2.5-lp150.2.25.1 References: https://www.suse.com/security/cve/CVE-2019-11041.html https://www.suse.com/security/cve/CVE-2019-11042.html https://bugzilla.suse.com/1145095 https://bugzilla.suse.com/1146360 https://bugzilla.suse.com/1151793

1 0

openSUSE-RU-2019:2270-1: moderate: Recommended update for aws-cli, python-boto3, python-botocore, python-s3transfer
by maintenance＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Recommended Update: Recommended update for aws-cli, python-boto3, python-botocore, python-s3transfer ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2270-1 Rating: moderate References: #1136184 #1146853 #1146854 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for aws-cli, python-boto3, python-botocore, python-s3transfer fixes the following issues: aws-cli was updated to version 1.16.223: For detailed changes see the changes entries: https://github.com/aws/aws-cli/blob/1.16.223/CHANGELOG.rst https://github.com/aws/aws-cli/blob/1.16.189/CHANGELOG.rst https://github.com/aws/aws-cli/blob/1.16.182/CHANGELOG.rst https://github.com/aws/aws-cli/blob/1.16.176/CHANGELOG.rst https://github.com/aws/aws-cli/blob/1.16.103/CHANGELOG.rst https://github.com/aws/aws-cli/blob/1.16.94/CHANGELOG.rst https://github.com/aws/aws-cli/blob/1.16.84/CHANGELOG.rst python-boto3 was updated to 1.9.213, python-botocore was updated to 1.9.188, and python-s3transfer was updated to 1.12.74, fixing lots of bugs and adding features (bsc#1146853, bsc#1146854) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2270=1 Package List: - openSUSE Leap 15.0 (noarch): aws-cli-1.16.223-lp150.8.1 python2-boto3-1.9.213-lp150.7.1 python2-botocore-1.12.213-lp150.7.1 python2-s3transfer-0.2.1-lp150.7.1 python3-boto3-1.9.213-lp150.7.1 python3-botocore-1.12.213-lp150.7.1 python3-s3transfer-0.2.1-lp150.7.1 References: https://bugzilla.suse.com/1136184 https://bugzilla.suse.com/1146853 https://bugzilla.suse.com/1146854

1 0

openSUSE-SU-2019:2263-1: important: Security update for bind
by opensuse-security＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2263-1 Rating: important References: #1118367 #1118368 #1138687 Cross-References: CVE-2019-6471 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for bind fixes the following issues: Security issue fixed: - CVE-2019-6471: Fixed a reachable assert in dispatch.c. (bsc#1138687) Non-security issue fixed: - bind will no longer rely on /etc/insserv.conf (bsc#1118367, bsc#1118368) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2263=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): bind-9.11.2-lp150.8.16.1 bind-chrootenv-9.11.2-lp150.8.16.1 bind-debuginfo-9.11.2-lp150.8.16.1 bind-debugsource-9.11.2-lp150.8.16.1 bind-devel-9.11.2-lp150.8.16.1 bind-lwresd-9.11.2-lp150.8.16.1 bind-lwresd-debuginfo-9.11.2-lp150.8.16.1 bind-utils-9.11.2-lp150.8.16.1 bind-utils-debuginfo-9.11.2-lp150.8.16.1 libbind9-160-9.11.2-lp150.8.16.1 libbind9-160-debuginfo-9.11.2-lp150.8.16.1 libdns169-9.11.2-lp150.8.16.1 libdns169-debuginfo-9.11.2-lp150.8.16.1 libirs-devel-9.11.2-lp150.8.16.1 libirs160-9.11.2-lp150.8.16.1 libirs160-debuginfo-9.11.2-lp150.8.16.1 libisc166-9.11.2-lp150.8.16.1 libisc166-debuginfo-9.11.2-lp150.8.16.1 libisccc160-9.11.2-lp150.8.16.1 libisccc160-debuginfo-9.11.2-lp150.8.16.1 libisccfg160-9.11.2-lp150.8.16.1 libisccfg160-debuginfo-9.11.2-lp150.8.16.1 liblwres160-9.11.2-lp150.8.16.1 liblwres160-debuginfo-9.11.2-lp150.8.16.1 - openSUSE Leap 15.0 (noarch): bind-doc-9.11.2-lp150.8.16.1 python3-bind-9.11.2-lp150.8.16.1 - openSUSE Leap 15.0 (x86_64): bind-devel-32bit-9.11.2-lp150.8.16.1 libbind9-160-32bit-9.11.2-lp150.8.16.1 libbind9-160-32bit-debuginfo-9.11.2-lp150.8.16.1 libdns169-32bit-9.11.2-lp150.8.16.1 libdns169-32bit-debuginfo-9.11.2-lp150.8.16.1 libirs160-32bit-9.11.2-lp150.8.16.1 libirs160-32bit-debuginfo-9.11.2-lp150.8.16.1 libisc166-32bit-9.11.2-lp150.8.16.1 libisc166-32bit-debuginfo-9.11.2-lp150.8.16.1 libisccc160-32bit-9.11.2-lp150.8.16.1 libisccc160-32bit-debuginfo-9.11.2-lp150.8.16.1 libisccfg160-32bit-9.11.2-lp150.8.16.1 libisccfg160-32bit-debuginfo-9.11.2-lp150.8.16.1 liblwres160-32bit-9.11.2-lp150.8.16.1 liblwres160-32bit-debuginfo-9.11.2-lp150.8.16.1 References: https://www.suse.com/security/cve/CVE-2019-6471.html https://bugzilla.suse.com/1118367 https://bugzilla.suse.com/1118368 https://bugzilla.suse.com/1138687

1 0

openSUSE-SU-2019:2260-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2260-1 Rating: important References: #1109465 #1117473 #1123482 #1124525 #1133810 #1138688 #1140868 #1141322 #1145665 #1149292 #1149293 #1149294 #1149295 #1149296 #1149297 #1149298 #1149299 #1149302 #1149303 #1149304 #1149323 Cross-References: CVE-2019-11710 CVE-2019-11714 CVE-2019-11716 CVE-2019-11718 CVE-2019-11720 CVE-2019-11721 CVE-2019-11723 CVE-2019-11724 CVE-2019-11725 CVE-2019-11727 CVE-2019-11728 CVE-2019-11733 CVE-2019-11735 CVE-2019-11736 CVE-2019-11738 CVE-2019-11740 CVE-2019-11742 CVE-2019-11743 CVE-2019-11744 CVE-2019-11746 CVE-2019-11747 CVE-2019-11748 CVE-2019-11749 CVE-2019-11750 CVE-2019-11751 CVE-2019-11752 CVE-2019-11753 CVE-2019-9811 CVE-2019-9812 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 29 vulnerabilities is now available. Description: This update for MozillaFirefox to 68.1 fixes the following issues: Security issues fixed: - CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868) - CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294) - CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868) - CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868) - CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868) - CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868) - CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868) - CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868) - CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868) - CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868) - CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868) - CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322) - CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868) - CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665) - CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293) - CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292) - CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302) - CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299) - CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303) - CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298) - CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304) - CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297) - CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296) - CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295) Non-security issues fixed: - Latest update now also released for s390x. (bsc#1109465) - Fixed a segmentation fault on s390vsl082. (bsc#1117473) - Fixed a crash on SLES15 s390x. (bsc#1124525) - Fixed a segmentation fault. (bsc#1133810) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2260=1 Package List: - openSUSE Leap 15.0 (x86_64): MozillaFirefox-68.1.0-lp150.3.66.1 MozillaFirefox-branding-upstream-68.1.0-lp150.3.66.1 MozillaFirefox-buildsymbols-68.1.0-lp150.3.66.1 MozillaFirefox-debuginfo-68.1.0-lp150.3.66.1 MozillaFirefox-debugsource-68.1.0-lp150.3.66.1 MozillaFirefox-devel-68.1.0-lp150.3.66.1 MozillaFirefox-translations-common-68.1.0-lp150.3.66.1 MozillaFirefox-translations-other-68.1.0-lp150.3.66.1 References: https://www.suse.com/security/cve/CVE-2019-11710.html https://www.suse.com/security/cve/CVE-2019-11714.html https://www.suse.com/security/cve/CVE-2019-11716.html https://www.suse.com/security/cve/CVE-2019-11718.html https://www.suse.com/security/cve/CVE-2019-11720.html https://www.suse.com/security/cve/CVE-2019-11721.html https://www.suse.com/security/cve/CVE-2019-11723.html https://www.suse.com/security/cve/CVE-2019-11724.html https://www.suse.com/security/cve/CVE-2019-11725.html https://www.suse.com/security/cve/CVE-2019-11727.html https://www.suse.com/security/cve/CVE-2019-11728.html https://www.suse.com/security/cve/CVE-2019-11733.html https://www.suse.com/security/cve/CVE-2019-11735.html https://www.suse.com/security/cve/CVE-2019-11736.html https://www.suse.com/security/cve/CVE-2019-11738.html https://www.suse.com/security/cve/CVE-2019-11740.html https://www.suse.com/security/cve/CVE-2019-11742.html https://www.suse.com/security/cve/CVE-2019-11743.html https://www.suse.com/security/cve/CVE-2019-11744.html https://www.suse.com/security/cve/CVE-2019-11746.html https://www.suse.com/security/cve/CVE-2019-11747.html https://www.suse.com/security/cve/CVE-2019-11748.html https://www.suse.com/security/cve/CVE-2019-11749.html https://www.suse.com/security/cve/CVE-2019-11750.html https://www.suse.com/security/cve/CVE-2019-11751.html https://www.suse.com/security/cve/CVE-2019-11752.html https://www.suse.com/security/cve/CVE-2019-11753.html https://www.suse.com/security/cve/CVE-2019-9811.html https://www.suse.com/security/cve/CVE-2019-9812.html https://bugzilla.suse.com/1109465 https://bugzilla.suse.com/1117473 https://bugzilla.suse.com/1123482 https://bugzilla.suse.com/1124525 https://bugzilla.suse.com/1133810 https://bugzilla.suse.com/1138688 https://bugzilla.suse.com/1140868 https://bugzilla.suse.com/1141322 https://bugzilla.suse.com/1145665 https://bugzilla.suse.com/1149292 https://bugzilla.suse.com/1149293 https://bugzilla.suse.com/1149294 https://bugzilla.suse.com/1149295 https://bugzilla.suse.com/1149296 https://bugzilla.suse.com/1149297 https://bugzilla.suse.com/1149298 https://bugzilla.suse.com/1149299 https://bugzilla.suse.com/1149302 https://bugzilla.suse.com/1149303 https://bugzilla.suse.com/1149304 https://bugzilla.suse.com/1149323

1 0

openSUSE-SU-2019:2269-1: moderate: Security update for openssl-1_0_0
by opensuse-security＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Security Update: Security update for openssl-1_0_0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2269-1 Rating: moderate References: #1131291 #1150003 #1150250 Cross-References: CVE-2019-1547 CVE-2019-1563 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for openssl-1_0_0 fixes the following issues: OpenSSL Security Advisory [10 September 2019] * CVE-2019-1547: Added EC_GROUP_set_generator side channel attack avoidance. (bsc#1150003) * CVE-2019-1563: Fixed Bleichenbacher attack against cms/pkcs7 encryption transported key (bsc#1150250) In addition fixed invalid curve attacks by validating that an EC point lies on the curve (bsc#1131291). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2269=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libopenssl-1_0_0-devel-1.0.2p-lp151.5.10.1 libopenssl1_0_0-1.0.2p-lp151.5.10.1 libopenssl1_0_0-debuginfo-1.0.2p-lp151.5.10.1 libopenssl1_0_0-hmac-1.0.2p-lp151.5.10.1 libopenssl1_0_0-steam-1.0.2p-lp151.5.10.1 libopenssl1_0_0-steam-debuginfo-1.0.2p-lp151.5.10.1 openssl-1_0_0-1.0.2p-lp151.5.10.1 openssl-1_0_0-cavs-1.0.2p-lp151.5.10.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-lp151.5.10.1 openssl-1_0_0-debuginfo-1.0.2p-lp151.5.10.1 openssl-1_0_0-debugsource-1.0.2p-lp151.5.10.1 - openSUSE Leap 15.1 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-lp151.5.10.1 libopenssl1_0_0-32bit-1.0.2p-lp151.5.10.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-lp151.5.10.1 libopenssl1_0_0-hmac-32bit-1.0.2p-lp151.5.10.1 libopenssl1_0_0-steam-32bit-1.0.2p-lp151.5.10.1 libopenssl1_0_0-steam-32bit-debuginfo-1.0.2p-lp151.5.10.1 - openSUSE Leap 15.1 (noarch): openssl-1_0_0-doc-1.0.2p-lp151.5.10.1 References: https://www.suse.com/security/cve/CVE-2019-1547.html https://www.suse.com/security/cve/CVE-2019-1563.html https://bugzilla.suse.com/1131291 https://bugzilla.suse.com/1150003 https://bugzilla.suse.com/1150250

1 0

openSUSE-SU-2019:2259-1: moderate: Security update for python-numpy
by opensuse-security＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Security Update: Security update for python-numpy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2259-1 Rating: moderate References: #1149203 Cross-References: CVE-2019-6446 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-numpy fixes the following issues: Non-security issues fixed: - Updated to upstream version 1.16.1. (bsc#1149203) (jsc#SLE-8532) This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2259=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): python2-numpy_1_16_1-gnu-hpc-1.16.1-bp151.2.3.1 python2-numpy_1_16_1-gnu-hpc-devel-1.16.1-bp151.2.3.1 python3-numpy_1_16_1-gnu-hpc-1.16.1-bp151.2.3.1 python3-numpy_1_16_1-gnu-hpc-devel-1.16.1-bp151.2.3.1 - openSUSE Backports SLE-15-SP1 (ppc64le s390x): python2-numpy-gnu-hpc-1.16.1-bp151.2.3.1 python2-numpy-gnu-hpc-devel-1.16.1-bp151.2.3.1 python3-numpy-gnu-hpc-1.16.1-bp151.2.3.1 python3-numpy-gnu-hpc-devel-1.16.1-bp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-6446.html https://bugzilla.suse.com/1149203

1 0