October 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:2235-1: moderate: Security update for u-boot
by opensuse-security＠opensuse.org 01 Oct '19

01 Oct '19

openSUSE Security Update: Security update for u-boot ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2235-1 Rating: moderate References: #1144656 #1144675 Cross-References: CVE-2019-13104 CVE-2019-13106 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for u-boot fixes the following issues: Security issues fixed: - CVE-2019-13106: Fixed stack buffer overflow via a crafted ext4 filesystem that may lead to code execution (bsc#1144656). - CVE-2019-13104: Fixed an underflow that could cause memcpy() to overwrite a very large amount of data via a crafted ext4 filesystem (bsc#1144675). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2235=1 Package List: - openSUSE Leap 15.0 (x86_64): u-boot-tools-2018.03-lp150.4.3.1 u-boot-tools-debuginfo-2018.03-lp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-13104.html https://www.suse.com/security/cve/CVE-2019-13106.html https://bugzilla.suse.com/1144656 https://bugzilla.suse.com/1144675

1 0

openSUSE-RU-2019:2237-1: moderate: Recommended update for openwsman
by maintenance＠opensuse.org 01 Oct '19

01 Oct '19

openSUSE Recommended Update: Recommended update for openwsman ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2237-1 Rating: moderate References: #1105331 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for openwsman fixes the following issues: - Adds CIM_NAMESPACE if it's not already present (bsc#1105331) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2237=1 Package List: - openSUSE Leap 15.0 (x86_64): libwsman-devel-2.6.7-lp150.2.6.1 libwsman3-2.6.7-lp150.2.6.1 libwsman3-debuginfo-2.6.7-lp150.2.6.1 libwsman_clientpp-devel-2.6.7-lp150.2.6.1 libwsman_clientpp1-2.6.7-lp150.2.6.1 libwsman_clientpp1-debuginfo-2.6.7-lp150.2.6.1 openwsman-debuginfo-2.6.7-lp150.2.6.1 openwsman-debugsource-2.6.7-lp150.2.6.1 openwsman-java-2.6.7-lp150.2.6.1 openwsman-perl-2.6.7-lp150.2.6.1 openwsman-perl-debuginfo-2.6.7-lp150.2.6.1 openwsman-ruby-2.6.7-lp150.2.6.1 openwsman-ruby-debuginfo-2.6.7-lp150.2.6.1 openwsman-ruby-docs-2.6.7-lp150.2.6.1 openwsman-server-2.6.7-lp150.2.6.1 openwsman-server-debuginfo-2.6.7-lp150.2.6.1 openwsman-server-plugin-ruby-2.6.7-lp150.2.6.1 openwsman-server-plugin-ruby-debuginfo-2.6.7-lp150.2.6.1 python3-openwsman-2.6.7-lp150.2.6.1 python3-openwsman-debuginfo-2.6.7-lp150.2.6.1 winrs-2.6.7-lp150.2.6.1 References: https://bugzilla.suse.com/1105331

1 0

openSUSE-SU-2019:2232-1: moderate: Security update for nghttp2
by opensuse-security＠opensuse.org 01 Oct '19

01 Oct '19

openSUSE Security Update: Security update for nghttp2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2232-1 Rating: moderate References: #1112438 #1125689 #1134616 #1146182 #1146184 Cross-References: CVE-2019-9511 CVE-2019-9513 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for nghttp2 fixes the following issues: Security issues fixed: - CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184). - CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#11461). Bug fixes and enhancements: - Fixed mistake in spec file (bsc#1125689) - Fixed build issue with boost 1.70.0 (bsc#1134616) - Feature: Add W&S module (FATE#326776, bsc#1112438) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2232=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libnghttp2-14-1.39.2-lp151.3.3.1 libnghttp2-14-debuginfo-1.39.2-lp151.3.3.1 libnghttp2-devel-1.39.2-lp151.3.3.1 libnghttp2_asio-devel-1.39.2-lp151.3.3.1 libnghttp2_asio1-1.39.2-lp151.3.3.1 libnghttp2_asio1-debuginfo-1.39.2-lp151.3.3.1 nghttp2-1.39.2-lp151.3.3.1 nghttp2-debuginfo-1.39.2-lp151.3.3.1 nghttp2-debugsource-1.39.2-lp151.3.3.1 nghttp2-python-debugsource-1.39.2-lp151.3.3.1 python3-nghttp2-1.39.2-lp151.3.3.1 python3-nghttp2-debuginfo-1.39.2-lp151.3.3.1 - openSUSE Leap 15.1 (x86_64): libnghttp2-14-32bit-1.39.2-lp151.3.3.1 libnghttp2-14-32bit-debuginfo-1.39.2-lp151.3.3.1 libnghttp2_asio1-32bit-1.39.2-lp151.3.3.1 libnghttp2_asio1-32bit-debuginfo-1.39.2-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-9511.html https://www.suse.com/security/cve/CVE-2019-9513.html https://bugzilla.suse.com/1112438 https://bugzilla.suse.com/1125689 https://bugzilla.suse.com/1134616 https://bugzilla.suse.com/1146182 https://bugzilla.suse.com/1146184

1 0

openSUSE-SU-2019:2233-1: moderate: Security update for u-boot
by opensuse-security＠opensuse.org 01 Oct '19

01 Oct '19

openSUSE Security Update: Security update for u-boot ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2233-1 Rating: moderate References: #1144656 #1144675 Cross-References: CVE-2019-13104 CVE-2019-13106 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for u-boot fixes the following issues: Security issues fixed: - CVE-2019-13106: Fixed stack buffer overflow via a crafted ext4 filesystem that may lead to code execution (bsc#1144656). - CVE-2019-13104: Fixed an underflow that could cause memcpy() to overwrite a very large amount of data via a crafted ext4 filesystem (bsc#1144675). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2233=1 Package List: - openSUSE Leap 15.1 (x86_64): u-boot-tools-2019.01-lp151.6.3.1 u-boot-tools-debuginfo-2019.01-lp151.6.3.1 References: https://www.suse.com/security/cve/CVE-2019-13104.html https://www.suse.com/security/cve/CVE-2019-13106.html https://bugzilla.suse.com/1144656 https://bugzilla.suse.com/1144675

1 0

openSUSE-RU-2019:2231-1: important: Recommended update for rmt-server
by maintenance＠opensuse.org 01 Oct '19

01 Oct '19

openSUSE Recommended Update: Recommended update for rmt-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2231-1 Rating: important References: #1136168 #1136178 #1138863 #1142641 #1145688 #1146611 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for rmt-server fixes the following issues: - Preserve cached metadata timestamps. (bsc#1146611) - Allow to mirror individual products/repositories. (bsc#1138863) - RMT now uses mirror_src to determine whether or not to download source packages. (bsc#1145688) - Fix RMT installer_repo call for empty release_type parameter. (bsc#1136178) - Clean up download queue on metadata download errors. (bsc#1142641) - Removed release stage from names to be consistent with SCC. (bsc#1136168) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2231=1 Package List: - openSUSE Leap 15.0 (x86_64): rmt-server-2.4.1-lp150.2.22.1 rmt-server-config-2.4.1-lp150.2.22.1 rmt-server-debuginfo-2.4.1-lp150.2.22.1 rmt-server-debugsource-2.4.1-lp150.2.22.1 rmt-server-pubcloud-2.4.1-lp150.2.22.1 References: https://bugzilla.suse.com/1136168 https://bugzilla.suse.com/1136178 https://bugzilla.suse.com/1138863 https://bugzilla.suse.com/1142641 https://bugzilla.suse.com/1145688 https://bugzilla.suse.com/1146611

1 0

openSUSE-SU-2019:2228-1: important: Security update for chromium
by opensuse-security＠opensuse.org 01 Oct '19

01 Oct '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2228-1 Rating: important References: #1151229 Cross-References: CVE-2019-13685 CVE-2019-13686 CVE-2019-13687 CVE-2019-13688 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for chromium to version 77.0.3865.90 fixes the following issues: - CVE-2019-13685: Fixed a use-after-free in UI. (boo#1151229) - CVE-2019-13688: Fixed a use-after-free in media. (boo#1151229) - CVE-2019-13687: Fixed a use-after-free in media. (boo#1151229) - CVE-2019-13686: Fixed a use-after-free in offline pages. (boo#1151229) This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2228=1 Package List: - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-77.0.3865.90-bp150.234.1 chromium-77.0.3865.90-bp150.234.1 References: https://www.suse.com/security/cve/CVE-2019-13685.html https://www.suse.com/security/cve/CVE-2019-13686.html https://www.suse.com/security/cve/CVE-2019-13687.html https://www.suse.com/security/cve/CVE-2019-13688.html https://bugzilla.suse.com/1151229

1 0

openSUSE-RU-2019:2230-1: moderate: Recommended update for perf
by maintenance＠opensuse.org 01 Oct '19

01 Oct '19

openSUSE Recommended Update: Recommended update for perf ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2230-1 Rating: moderate References: #1117114 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for perf provides the following fixes: - Correctly list implementation defined events on Cavium. (bsc#1117114) - Fix core dump in `perf stat -e` on Cavium. (bsc#1117114) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2230=1 Package List: - openSUSE Leap 15.1 (x86_64): perf-4.12.14-lp151.17.6.1 perf-debuginfo-4.12.14-lp151.17.6.1 perf-debugsource-4.12.14-lp151.17.6.1 References: https://bugzilla.suse.com/1117114

1 0

openSUSE-SU-2019:2229-1: important: Security update for chromium
by opensuse-security＠opensuse.org 01 Oct '19

01 Oct '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2229-1 Rating: important References: #1151229 Cross-References: CVE-2019-13685 CVE-2019-13686 CVE-2019-13687 CVE-2019-13688 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for chromium to version 77.0.3865.90 fixes the following issues: - CVE-2019-13685: Fixed a use-after-free in UI. (boo#1151229) - CVE-2019-13688: Fixed a use-after-free in media. (boo#1151229) - CVE-2019-13687: Fixed a use-after-free in media. (boo#1151229) - CVE-2019-13686: Fixed a use-after-free in offline pages. (boo#1151229) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2229=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-77.0.3865.90-bp151.3.15.1 chromium-77.0.3865.90-bp151.3.15.1 References: https://www.suse.com/security/cve/CVE-2019-13685.html https://www.suse.com/security/cve/CVE-2019-13686.html https://www.suse.com/security/cve/CVE-2019-13687.html https://www.suse.com/security/cve/CVE-2019-13688.html https://bugzilla.suse.com/1151229

1 0