November 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:2425-1: important: Security update for chromium, re2
by opensuse-security＠opensuse.org 03 Nov '19

03 Nov '19

openSUSE Security Update: Security update for chromium, re2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2425-1 Rating: important References: #1154806 Cross-References: CVE-2019-13699 CVE-2019-13700 CVE-2019-13701 CVE-2019-13702 CVE-2019-13703 CVE-2019-13704 CVE-2019-13705 CVE-2019-13706 CVE-2019-13707 CVE-2019-13708 CVE-2019-13709 CVE-2019-13710 CVE-2019-13711 CVE-2019-13713 CVE-2019-13714 CVE-2019-13715 CVE-2019-13716 CVE-2019-13717 CVE-2019-13718 CVE-2019-13719 CVE-2019-15903 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: This update for chromium, re2 fixes the following issues: Chromium was updated to 78.0.3904.70 boo#1154806: * CVE-2019-13699: Use-after-free in media * CVE-2019-13700: Buffer overrun in Blink * CVE-2019-13701: URL spoof in navigation * CVE-2019-13702: Privilege elevation in Installer * CVE-2019-13703: URL bar spoofing * CVE-2019-13704: CSP bypass * CVE-2019-13705: Extension permission bypass * CVE-2019-13706: Out-of-bounds read in PDFium * CVE-2019-13707: File storage disclosure * CVE-2019-13708: HTTP authentication spoof * CVE-2019-13709: File download protection bypass * CVE-2019-13710: File download protection bypass * CVE-2019-13711: Cross-context information leak * CVE-2019-15903: Buffer overflow in expat * CVE-2019-13713: Cross-origin data leak * CVE-2019-13714: CSS injection * CVE-2019-13715: Address bar spoofing * CVE-2019-13716: Service worker state error * CVE-2019-13717: Notification obscured * CVE-2019-13718: IDN spoof * CVE-2019-13719: Notification obscured * Various fixes from internal audits, fuzzing and other initiatives - Use internal resources for icon and appdata This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2425=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): libre2-0-20190901-bp151.6.3.1 libre2-0-debuginfo-20190901-bp151.6.3.1 re2-debugsource-20190901-bp151.6.3.1 re2-devel-20190901-bp151.6.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): chromedriver-78.0.3904.70-bp151.3.21.1 chromium-78.0.3904.70-bp151.3.21.1 - openSUSE Backports SLE-15-SP1 (aarch64_ilp32): libre2-0-64bit-20190901-bp151.6.3.1 libre2-0-64bit-debuginfo-20190901-bp151.6.3.1 References: https://www.suse.com/security/cve/CVE-2019-13699.html https://www.suse.com/security/cve/CVE-2019-13700.html https://www.suse.com/security/cve/CVE-2019-13701.html https://www.suse.com/security/cve/CVE-2019-13702.html https://www.suse.com/security/cve/CVE-2019-13703.html https://www.suse.com/security/cve/CVE-2019-13704.html https://www.suse.com/security/cve/CVE-2019-13705.html https://www.suse.com/security/cve/CVE-2019-13706.html https://www.suse.com/security/cve/CVE-2019-13707.html https://www.suse.com/security/cve/CVE-2019-13708.html https://www.suse.com/security/cve/CVE-2019-13709.html https://www.suse.com/security/cve/CVE-2019-13710.html https://www.suse.com/security/cve/CVE-2019-13711.html https://www.suse.com/security/cve/CVE-2019-13713.html https://www.suse.com/security/cve/CVE-2019-13714.html https://www.suse.com/security/cve/CVE-2019-13715.html https://www.suse.com/security/cve/CVE-2019-13716.html https://www.suse.com/security/cve/CVE-2019-13717.html https://www.suse.com/security/cve/CVE-2019-13718.html https://www.suse.com/security/cve/CVE-2019-13719.html https://www.suse.com/security/cve/CVE-2019-15903.html https://bugzilla.suse.com/1154806

1 0

openSUSE-SU-2019:2424-1: important: Security update for chromium, re2
by opensuse-security＠opensuse.org 03 Nov '19

03 Nov '19

openSUSE Security Update: Security update for chromium, re2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2424-1 Rating: important References: #1154806 Cross-References: CVE-2019-13699 CVE-2019-13700 CVE-2019-13701 CVE-2019-13702 CVE-2019-13703 CVE-2019-13704 CVE-2019-13705 CVE-2019-13706 CVE-2019-13707 CVE-2019-13708 CVE-2019-13709 CVE-2019-13710 CVE-2019-13711 CVE-2019-13713 CVE-2019-13714 CVE-2019-13715 CVE-2019-13716 CVE-2019-13717 CVE-2019-13718 CVE-2019-13719 CVE-2019-15903 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: This update for chromium, re2 fixes the following issues: Chromium was updated to 78.0.3904.70 boo#1154806: * CVE-2019-13699: Use-after-free in media * CVE-2019-13700: Buffer overrun in Blink * CVE-2019-13701: URL spoof in navigation * CVE-2019-13702: Privilege elevation in Installer * CVE-2019-13703: URL bar spoofing * CVE-2019-13704: CSP bypass * CVE-2019-13705: Extension permission bypass * CVE-2019-13706: Out-of-bounds read in PDFium * CVE-2019-13707: File storage disclosure * CVE-2019-13708: HTTP authentication spoof * CVE-2019-13709: File download protection bypass * CVE-2019-13710: File download protection bypass * CVE-2019-13711: Cross-context information leak * CVE-2019-15903: Buffer overflow in expat * CVE-2019-13713: Cross-origin data leak * CVE-2019-13714: CSS injection * CVE-2019-13715: Address bar spoofing * CVE-2019-13716: Service worker state error * CVE-2019-13717: Notification obscured * CVE-2019-13718: IDN spoof * CVE-2019-13719: Notification obscured * Various fixes from internal audits, fuzzing and other initiatives - Use internal resources for icon and appdata This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2424=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libre2-0-20190901-bp150.25.1 libre2-0-debuginfo-20190901-bp150.25.1 re2-debugsource-20190901-bp150.25.1 re2-devel-20190901-bp150.25.1 - openSUSE Backports SLE-15 (aarch64 x86_64): chromedriver-78.0.3904.70-bp150.240.1 chromium-78.0.3904.70-bp150.240.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libre2-0-64bit-20190901-bp150.25.1 libre2-0-64bit-debuginfo-20190901-bp150.25.1 References: https://www.suse.com/security/cve/CVE-2019-13699.html https://www.suse.com/security/cve/CVE-2019-13700.html https://www.suse.com/security/cve/CVE-2019-13701.html https://www.suse.com/security/cve/CVE-2019-13702.html https://www.suse.com/security/cve/CVE-2019-13703.html https://www.suse.com/security/cve/CVE-2019-13704.html https://www.suse.com/security/cve/CVE-2019-13705.html https://www.suse.com/security/cve/CVE-2019-13706.html https://www.suse.com/security/cve/CVE-2019-13707.html https://www.suse.com/security/cve/CVE-2019-13708.html https://www.suse.com/security/cve/CVE-2019-13709.html https://www.suse.com/security/cve/CVE-2019-13710.html https://www.suse.com/security/cve/CVE-2019-13711.html https://www.suse.com/security/cve/CVE-2019-13713.html https://www.suse.com/security/cve/CVE-2019-13714.html https://www.suse.com/security/cve/CVE-2019-13715.html https://www.suse.com/security/cve/CVE-2019-13716.html https://www.suse.com/security/cve/CVE-2019-13717.html https://www.suse.com/security/cve/CVE-2019-13718.html https://www.suse.com/security/cve/CVE-2019-13719.html https://www.suse.com/security/cve/CVE-2019-15903.html https://bugzilla.suse.com/1154806

1 0

openSUSE-SU-2019:2421-1: important: Security update for chromium
by opensuse-security＠opensuse.org 02 Nov '19

02 Nov '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2421-1 Rating: important References: #1155643 Cross-References: CVE-2019-13720 CVE-2019-13721 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium was updated to 78.0.3904.87 boo#1155643: * CVE-2019-13721: Use-after-free in PDFium * CVE-2019-13720: Use-after-free in audio Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2421=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2421=1 Package List: - openSUSE Leap 15.1 (x86_64): chromedriver-78.0.3904.87-lp151.2.42.1 chromedriver-debuginfo-78.0.3904.87-lp151.2.42.1 chromium-78.0.3904.87-lp151.2.42.1 chromium-debuginfo-78.0.3904.87-lp151.2.42.1 chromium-debugsource-78.0.3904.87-lp151.2.42.1 - openSUSE Leap 15.0 (x86_64): chromedriver-78.0.3904.87-lp150.251.1 chromedriver-debuginfo-78.0.3904.87-lp150.251.1 chromium-78.0.3904.87-lp150.251.1 chromium-debuginfo-78.0.3904.87-lp150.251.1 chromium-debugsource-78.0.3904.87-lp150.251.1 References: https://www.suse.com/security/cve/CVE-2019-13720.html https://www.suse.com/security/cve/CVE-2019-13721.html https://bugzilla.suse.com/1155643

1 0

openSUSE-RU-2019:2422-1: moderate: Recommended update for accountsservice
by maintenance＠opensuse.org 02 Nov '19

02 Nov '19

openSUSE Recommended Update: Recommended update for accountsservice ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2422-1 Rating: moderate References: #1114292 #1139487 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for accountsservice provides the following fixes: - Improve wtmp IO performance. (bsc#1139487) - Amend the fix allowing gdm to store WM selection for root. (bsc#1114292) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2422=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): accountsservice-0.6.45-lp150.3.10.1 accountsservice-debuginfo-0.6.45-lp150.3.10.1 accountsservice-debugsource-0.6.45-lp150.3.10.1 accountsservice-devel-0.6.45-lp150.3.10.1 libaccountsservice0-0.6.45-lp150.3.10.1 libaccountsservice0-debuginfo-0.6.45-lp150.3.10.1 typelib-1_0-AccountsService-1_0-0.6.45-lp150.3.10.1 - openSUSE Leap 15.0 (noarch): accountsservice-lang-0.6.45-lp150.3.10.1 References: https://bugzilla.suse.com/1114292 https://bugzilla.suse.com/1139487

1 0

openSUSE-RU-2019:2423-1: moderate: Recommended update for crmsh
by maintenance＠opensuse.org 02 Nov '19

02 Nov '19

openSUSE Recommended Update: Recommended update for crmsh ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2423-1 Rating: moderate References: #1127716 #1129210 #1129317 #1129383 #1129702 #1130715 #1135585 #1135586 #1135696 #1138115 #1138405 #1145823 #1146922 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 13 recommended fixes can now be installed. Description: This update for crmsh contains the following fixes: - Update to version 4.1.0+git.1569593061.35f57072: * Fix: utils: fix logic for process non comments line. (bsc#1145823) * High: cibconfig: Correctly sanitize the original CIB as patch base. (bsc#1127716, bsc#1138405) * Revert "High: cibconfig: Use correct CIB as patch base". (bsc#1127716) * Partially revert "Medium: cibconfig: Sanitize CIB for patching". (bsc#1127716) * Update changelog from 3.0.0 to 4.1.0 * Fix: utils: issue in to_ascii. (bsc#1138115) * Fix: bootstrap: bindnetaddr should accept both network and specific IP. (bsc#1135585, bsc#1135586) * Fix: hb_report: analysis.txt should includes warning, error, critical messages. (bsc#1135696) * Medium: ui_node: Check corosync state before clearstate. (bsc#1129702) * Fix: hb_report: handle UnicodeDecodeError: (bsc#1130715) * setting error='replace' to replace invalid utf-8 characters * try to catch UnicodeDecodeError and print traceback * Medium: cibconfig: Sanitize CIB for patching. (bsc#1127716) * High: cibconfig: Use correct CIB as patch base. (bsc#1127716) * Medium: parse: Detect and error on illegal ordering of op attributes. (bsc#1129210) * Medium: utils: Handle sysconfig values containing. (bsc#1129317) * Low: hb_report: collect output of "sbd dump" and "sbd list". (bsc#1129383) * High: hbreport: fix UnicodeEncodeError while print. (bsc#1146922) - Drop merged patches. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2423=1 Package List: - openSUSE Leap 15.0 (noarch): crmsh-4.1.0+git.1569593061.35f57072-lp150.2.16.1 crmsh-scripts-4.1.0+git.1569593061.35f57072-lp150.2.16.1 crmsh-test-4.1.0+git.1569593061.35f57072-lp150.2.16.1 References: https://bugzilla.suse.com/1127716 https://bugzilla.suse.com/1129210 https://bugzilla.suse.com/1129317 https://bugzilla.suse.com/1129383 https://bugzilla.suse.com/1129702 https://bugzilla.suse.com/1130715 https://bugzilla.suse.com/1135585 https://bugzilla.suse.com/1135586 https://bugzilla.suse.com/1135696 https://bugzilla.suse.com/1138115 https://bugzilla.suse.com/1138405 https://bugzilla.suse.com/1145823 https://bugzilla.suse.com/1146922

1 0

openSUSE-SU-2019:2420-1: important: Security update for chromium, re2
by opensuse-security＠opensuse.org 02 Nov '19

02 Nov '19

openSUSE Security Update: Security update for chromium, re2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2420-1 Rating: important References: #1154806 Cross-References: CVE-2019-13699 CVE-2019-13700 CVE-2019-13701 CVE-2019-13702 CVE-2019-13703 CVE-2019-13704 CVE-2019-13705 CVE-2019-13706 CVE-2019-13707 CVE-2019-13708 CVE-2019-13709 CVE-2019-13710 CVE-2019-13711 CVE-2019-13713 CVE-2019-13714 CVE-2019-13715 CVE-2019-13716 CVE-2019-13717 CVE-2019-13718 CVE-2019-13719 CVE-2019-15903 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: This update for chromium, re2 fixes the following issues: Chromium was updated to 78.0.3904.70 boo#1154806: * CVE-2019-13699: Use-after-free in media * CVE-2019-13700: Buffer overrun in Blink * CVE-2019-13701: URL spoof in navigation * CVE-2019-13702: Privilege elevation in Installer * CVE-2019-13703: URL bar spoofing * CVE-2019-13704: CSP bypass * CVE-2019-13705: Extension permission bypass * CVE-2019-13706: Out-of-bounds read in PDFium * CVE-2019-13707: File storage disclosure * CVE-2019-13708: HTTP authentication spoof * CVE-2019-13709: File download protection bypass * CVE-2019-13710: File download protection bypass * CVE-2019-13711: Cross-context information leak * CVE-2019-15903: Buffer overflow in expat * CVE-2019-13713: Cross-origin data leak * CVE-2019-13714: CSS injection * CVE-2019-13715: Address bar spoofing * CVE-2019-13716: Service worker state error * CVE-2019-13717: Notification obscured * CVE-2019-13718: IDN spoof * CVE-2019-13719: Notification obscured * Various fixes from internal audits, fuzzing and other initiatives - Use internal resources for icon and appdata Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2420=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2420=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libre2-0-20190901-lp151.10.3.1 libre2-0-debuginfo-20190901-lp151.10.3.1 re2-debugsource-20190901-lp151.10.3.1 re2-devel-20190901-lp151.10.3.1 - openSUSE Leap 15.1 (x86_64): chromedriver-78.0.3904.70-lp151.2.39.1 chromedriver-debuginfo-78.0.3904.70-lp151.2.39.1 chromium-78.0.3904.70-lp151.2.39.1 chromium-debuginfo-78.0.3904.70-lp151.2.39.1 chromium-debugsource-78.0.3904.70-lp151.2.39.1 libre2-0-32bit-20190901-lp151.10.3.1 libre2-0-32bit-debuginfo-20190901-lp151.10.3.1 - openSUSE Leap 15.0 (i586 x86_64): libre2-0-20190901-lp150.25.1 libre2-0-debuginfo-20190901-lp150.25.1 re2-debugsource-20190901-lp150.25.1 re2-devel-20190901-lp150.25.1 - openSUSE Leap 15.0 (x86_64): chromedriver-78.0.3904.70-lp150.248.2 chromedriver-debuginfo-78.0.3904.70-lp150.248.2 chromium-78.0.3904.70-lp150.248.2 chromium-debuginfo-78.0.3904.70-lp150.248.2 chromium-debugsource-78.0.3904.70-lp150.248.2 libre2-0-32bit-20190901-lp150.25.1 libre2-0-32bit-debuginfo-20190901-lp150.25.1 References: https://www.suse.com/security/cve/CVE-2019-13699.html https://www.suse.com/security/cve/CVE-2019-13700.html https://www.suse.com/security/cve/CVE-2019-13701.html https://www.suse.com/security/cve/CVE-2019-13702.html https://www.suse.com/security/cve/CVE-2019-13703.html https://www.suse.com/security/cve/CVE-2019-13704.html https://www.suse.com/security/cve/CVE-2019-13705.html https://www.suse.com/security/cve/CVE-2019-13706.html https://www.suse.com/security/cve/CVE-2019-13707.html https://www.suse.com/security/cve/CVE-2019-13708.html https://www.suse.com/security/cve/CVE-2019-13709.html https://www.suse.com/security/cve/CVE-2019-13710.html https://www.suse.com/security/cve/CVE-2019-13711.html https://www.suse.com/security/cve/CVE-2019-13713.html https://www.suse.com/security/cve/CVE-2019-13714.html https://www.suse.com/security/cve/CVE-2019-13715.html https://www.suse.com/security/cve/CVE-2019-13716.html https://www.suse.com/security/cve/CVE-2019-13717.html https://www.suse.com/security/cve/CVE-2019-13718.html https://www.suse.com/security/cve/CVE-2019-13719.html https://www.suse.com/security/cve/CVE-2019-15903.html https://bugzilla.suse.com/1154806

1 0