October 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:2264-1: moderate: Security update for nginx
by opensuse-security＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Security Update: Security update for nginx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2264-1 Rating: moderate References: #1145579 #1145580 #1145582 Cross-References: CVE-2019-9511 CVE-2019-9513 CVE-2019-9516 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nginx fixes the following issues: Security issues fixed: - CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579). - CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580). - CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2264=1 Package List: - openSUSE Leap 15.0 (x86_64): nginx-1.14.2-lp150.2.11.1 nginx-debuginfo-1.14.2-lp150.2.11.1 nginx-debugsource-1.14.2-lp150.2.11.1 - openSUSE Leap 15.0 (noarch): vim-plugin-nginx-1.14.2-lp150.2.11.1 References: https://www.suse.com/security/cve/CVE-2019-9511.html https://www.suse.com/security/cve/CVE-2019-9513.html https://www.suse.com/security/cve/CVE-2019-9516.html https://bugzilla.suse.com/1145579 https://bugzilla.suse.com/1145580 https://bugzilla.suse.com/1145582

1 0

openSUSE-SU-2019:2265-1: important: Security update for bind
by opensuse-security＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2265-1 Rating: important References: #1118367 #1118368 #1138687 Cross-References: CVE-2019-6471 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for bind fixes the following issues: Security issue fixed: - CVE-2019-6471: Fixed a reachable assert in dispatch.c. (bsc#1138687) Non-security issue fixed: - bind will no longer rely on /etc/insserv.conf (bsc#1118367, bsc#1118368) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2265=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): bind-9.11.2-lp151.11.6.1 bind-chrootenv-9.11.2-lp151.11.6.1 bind-debuginfo-9.11.2-lp151.11.6.1 bind-debugsource-9.11.2-lp151.11.6.1 bind-devel-9.11.2-lp151.11.6.1 bind-lwresd-9.11.2-lp151.11.6.1 bind-lwresd-debuginfo-9.11.2-lp151.11.6.1 bind-utils-9.11.2-lp151.11.6.1 bind-utils-debuginfo-9.11.2-lp151.11.6.1 libbind9-160-9.11.2-lp151.11.6.1 libbind9-160-debuginfo-9.11.2-lp151.11.6.1 libdns169-9.11.2-lp151.11.6.1 libdns169-debuginfo-9.11.2-lp151.11.6.1 libirs-devel-9.11.2-lp151.11.6.1 libirs160-9.11.2-lp151.11.6.1 libirs160-debuginfo-9.11.2-lp151.11.6.1 libisc166-9.11.2-lp151.11.6.1 libisc166-debuginfo-9.11.2-lp151.11.6.1 libisccc160-9.11.2-lp151.11.6.1 libisccc160-debuginfo-9.11.2-lp151.11.6.1 libisccfg160-9.11.2-lp151.11.6.1 libisccfg160-debuginfo-9.11.2-lp151.11.6.1 liblwres160-9.11.2-lp151.11.6.1 liblwres160-debuginfo-9.11.2-lp151.11.6.1 - openSUSE Leap 15.1 (x86_64): bind-devel-32bit-9.11.2-lp151.11.6.1 libbind9-160-32bit-9.11.2-lp151.11.6.1 libbind9-160-32bit-debuginfo-9.11.2-lp151.11.6.1 libdns169-32bit-9.11.2-lp151.11.6.1 libdns169-32bit-debuginfo-9.11.2-lp151.11.6.1 libirs160-32bit-9.11.2-lp151.11.6.1 libirs160-32bit-debuginfo-9.11.2-lp151.11.6.1 libisc166-32bit-9.11.2-lp151.11.6.1 libisc166-32bit-debuginfo-9.11.2-lp151.11.6.1 libisccc160-32bit-9.11.2-lp151.11.6.1 libisccc160-32bit-debuginfo-9.11.2-lp151.11.6.1 libisccfg160-32bit-9.11.2-lp151.11.6.1 libisccfg160-32bit-debuginfo-9.11.2-lp151.11.6.1 liblwres160-32bit-9.11.2-lp151.11.6.1 liblwres160-32bit-debuginfo-9.11.2-lp151.11.6.1 - openSUSE Leap 15.1 (noarch): bind-doc-9.11.2-lp151.11.6.1 python3-bind-9.11.2-lp151.11.6.1 References: https://www.suse.com/security/cve/CVE-2019-6471.html https://bugzilla.suse.com/1118367 https://bugzilla.suse.com/1118368 https://bugzilla.suse.com/1138687

1 0

openSUSE-RU-2019:2266-1: moderate: Recommended update for drbd
by maintenance＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Recommended Update: Recommended update for drbd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2266-1 Rating: moderate References: #1146117 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for drbd contains the following fixes: - Disallow dual primaries when not configured. (bsc#1146117) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2266=1 Package List: - openSUSE Leap 15.1 (x86_64): drbd-9.0.16+git.ab9777df-lp151.5.3.1 drbd-debugsource-9.0.16+git.ab9777df-lp151.5.3.1 drbd-kmp-default-9.0.16+git.ab9777df_k4.12.14_lp151.28.16-lp151.5.3.1 drbd-kmp-default-debuginfo-9.0.16+git.ab9777df_k4.12.14_lp151.28.16-lp151.5.3.1 References: https://bugzilla.suse.com/1146117

1 0

openSUSE-RU-2019:2262-1: moderate: Recommended update for suse-prime
by maintenance＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Recommended Update: Recommended update for suse-prime ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2262-1 Rating: moderate References: #1152911 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for suse-prime fixes the following issues: * get rid of unsettling update-alternatives error message; latest G05 drivers no longer need update-alternatives for libglx Xserver module (boo#1152911) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2262=1 Package List: - openSUSE Leap 15.1 (noarch): suse-prime-0.5-lp151.3.3.1 References: https://bugzilla.suse.com/1152911

1 0

openSUSE-RU-2019:2267-1: moderate: Recommended update for drbd-utils
by maintenance＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Recommended Update: Recommended update for drbd-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2267-1 Rating: moderate References: #1145296 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for drbd-utils contains the following fixes: - Fix the wrong return code with cib_apply_diff. (bsc#1145296) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2267=1 Package List: - openSUSE Leap 15.1 (x86_64): drbd-utils-9.6.0-lp151.2.3.1 drbd-utils-debuginfo-9.6.0-lp151.2.3.1 drbd-utils-debugsource-9.6.0-lp151.2.3.1 References: https://bugzilla.suse.com/1145296

1 0

openSUSE-RU-2019:2261-1: moderate: Recommended update for lxd
by maintenance＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Recommended Update: Recommended update for lxd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2261-1 Rating: moderate References: #1152846 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for lxd fixes the following issues: Update to LXD 3.18. The full upstream changelog is available from (boo#1152846): https://discuss.linuxcontainers.org/t/lxd-3-18-has-been-released/5869 + New /1.0/instances endpoint + Support for storing VM images + Extended disk resources information + Modification of image expiry date + Clustering roles + IPv4 configuration when in Fan mode Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2261=1 Package List: - openSUSE Leap 15.1 (noarch): lxd-bash-completion-3.18-lp151.11.1 - openSUSE Leap 15.1 (x86_64): lxd-3.18-lp151.11.1 References: https://bugzilla.suse.com/1152846

1 0

openSUSE-SU-2019:2268-1: moderate: Security update for openssl-1_0_0
by opensuse-security＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Security Update: Security update for openssl-1_0_0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2268-1 Rating: moderate References: #1131291 #1150003 #1150250 Cross-References: CVE-2019-1547 CVE-2019-1563 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for openssl-1_0_0 fixes the following issues: OpenSSL Security Advisory [10 September 2019] * CVE-2019-1547: Added EC_GROUP_set_generator side channel attack avoidance. (bsc#1150003) * CVE-2019-1563: Fixed Bleichenbacher attack against cms/pkcs7 encryption transported key (bsc#1150250) In addition fixed invalid curve attacks by validating that an EC point lies on the curve (bsc#1131291). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2268=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libopenssl-1_0_0-devel-1.0.2p-lp150.2.19.1 libopenssl1_0_0-1.0.2p-lp150.2.19.1 libopenssl1_0_0-debuginfo-1.0.2p-lp150.2.19.1 libopenssl1_0_0-hmac-1.0.2p-lp150.2.19.1 libopenssl1_0_0-steam-1.0.2p-lp150.2.19.1 libopenssl1_0_0-steam-debuginfo-1.0.2p-lp150.2.19.1 openssl-1_0_0-1.0.2p-lp150.2.19.1 openssl-1_0_0-cavs-1.0.2p-lp150.2.19.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-lp150.2.19.1 openssl-1_0_0-debuginfo-1.0.2p-lp150.2.19.1 openssl-1_0_0-debugsource-1.0.2p-lp150.2.19.1 - openSUSE Leap 15.0 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-lp150.2.19.1 libopenssl1_0_0-32bit-1.0.2p-lp150.2.19.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-lp150.2.19.1 libopenssl1_0_0-hmac-32bit-1.0.2p-lp150.2.19.1 libopenssl1_0_0-steam-32bit-1.0.2p-lp150.2.19.1 libopenssl1_0_0-steam-32bit-debuginfo-1.0.2p-lp150.2.19.1 - openSUSE Leap 15.0 (noarch): openssl-1_0_0-doc-1.0.2p-lp150.2.19.1 References: https://www.suse.com/security/cve/CVE-2019-1547.html https://www.suse.com/security/cve/CVE-2019-1563.html https://bugzilla.suse.com/1131291 https://bugzilla.suse.com/1150003 https://bugzilla.suse.com/1150250

1 0

openSUSE-OU-2019:2257-1: Optional update for yast2-rdp
by maintenance＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Optional Update: Optional update for yast2-rdp ______________________________________________________________________________ Announcement ID: openSUSE-OU-2019:2257-1 Rating: low References: #1142282 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for yast2-rdp doesn't fix any user relevant issues. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2257=1 Package List: - openSUSE Leap 15.0 (noarch): yast2-rdp-4.0.2.1-lp150.7.1 References: https://bugzilla.suse.com/1142282

1 0

openSUSE-OU-2019:2258-1: Optional update for yast2-rdp
by maintenance＠opensuse.org 06 Oct '19

06 Oct '19

openSUSE Optional Update: Optional update for yast2-rdp ______________________________________________________________________________ Announcement ID: openSUSE-OU-2019:2258-1 Rating: low References: #1142282 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for yast2-rdp doesn't fix any user relevant issues. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2258=1 Package List: - openSUSE Leap 15.1 (noarch): yast2-rdp-4.1.1-lp151.2.3.1 References: https://bugzilla.suse.com/1142282

1 0

openSUSE-RU-2019:2253-1: important: Recommended update for cloud-init
by maintenance＠opensuse.org 05 Oct '19

05 Oct '19

openSUSE Recommended Update: Recommended update for cloud-init ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2253-1 Rating: important References: #1144363 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for cloud-init fixes the following issues: - Fixes a regression which was introduced by fixing a different bug in the last maintenance update for cloud-init (bsc#1144363) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2253=1 Package List: - openSUSE Leap 15.0 (x86_64): cloud-init-19.1-lp150.2.19.1 cloud-init-config-suse-19.1-lp150.2.19.1 cloud-init-doc-19.1-lp150.2.19.1 References: https://bugzilla.suse.com/1144363

1 0