December 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2019:2603-1: moderate: Recommended update for gnuhealth-thalamus
by maintenance＠opensuse.org 01 Dec '19

01 Dec '19

openSUSE Recommended Update: Recommended update for gnuhealth-thalamus ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2603-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for gnuhealth-thalamus fixes the following issues: Version 0.9.11 update. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2603=1 Package List: - openSUSE Leap 15.1 (noarch): gnuhealth-thalamus-0.9.11-lp151.2.6.1 References:

1 0

openSUSE-RU-2019:2601-1: Recommended update for gpg2
by maintenance＠opensuse.org 01 Dec '19

01 Dec '19

openSUSE Recommended Update: Recommended update for gpg2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2601-1 Rating: low References: #1152755 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gpg2 provides the following fix: - Remove a build requirement on self. This is causing Leap 15.2 bootstrap to fail. (bsc#1152755) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2601=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): gpg2-2.2.5-lp150.3.13.1 gpg2-debuginfo-2.2.5-lp150.3.13.1 gpg2-debugsource-2.2.5-lp150.3.13.1 - openSUSE Leap 15.0 (noarch): gpg2-lang-2.2.5-lp150.3.13.1 References: https://bugzilla.suse.com/1152755

1 0

openSUSE-RU-2019:2600-1: moderate: Recommended update for imap
by maintenance＠opensuse.org 01 Dec '19

01 Dec '19

openSUSE Recommended Update: Recommended update for imap ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:2600-1 Rating: moderate References: #1145195 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for imap fixes the following issues: - read certificates from /etc/imap/certs ([boo#1145195]) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2600=1 Package List: - openSUSE Leap 15.1 (x86_64): imap-2007e_suse-lp151.4.3.1 imap-debuginfo-2007e_suse-lp151.4.3.1 imap-debugsource-2007e_suse-lp151.4.3.1 imap-devel-2007e_suse-lp151.4.3.1 libc-client2007e_suse-2007e_suse-lp151.4.3.1 libc-client2007e_suse-debuginfo-2007e_suse-lp151.4.3.1 References: https://bugzilla.suse.com/1145195

1 0

openSUSE-SU-2019:2599-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 01 Dec '19

01 Dec '19

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2599-1 Rating: moderate References: #1157614 Cross-References: CVE-2019-18622 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for phpMyAdmin fixes the following issues: phpMyAdmin was updated to 4.9.2: * CVE-2019-18622: SQL injection in Designer feature (boo#1157614) * Fixes for "Failed to set session cookie" error * Advisor with MySQL 8.0.3 and newer * Fix PHP deprecation errors * Fix a situation where exporting users after a delete query could remove users * Fix incorrect "You do not have privileges to manipulate with the users!" warning * Fix copying a database's privileges and several other problems moving columns with MariaDB * Fix for phpMyAdmin not selecting all the values when using shift-click to select during Export Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2599=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2599=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2599=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2599=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-2599=1 Package List: - openSUSE Leap 15.1 (noarch): phpMyAdmin-4.9.2-lp151.2.9.1 - openSUSE Leap 15.0 (noarch): phpMyAdmin-4.9.2-lp150.37.1 - openSUSE Backports SLE-15-SP1 (noarch): phpMyAdmin-4.9.2-bp151.3.9.1 - openSUSE Backports SLE-15 (noarch): phpMyAdmin-4.9.2-bp150.37.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.9.2-37.1 References: https://www.suse.com/security/cve/CVE-2019-18622.html https://bugzilla.suse.com/1157614

1 0

openSUSE-SU-2019:2599-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 01 Dec '19

01 Dec '19

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2599-1 Rating: moderate References: #1157614 Cross-References: CVE-2019-18622 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for phpMyAdmin fixes the following issues: phpMyAdmin was updated to 4.9.2: * CVE-2019-18622: SQL injection in Designer feature (boo#1157614) * Fixes for "Failed to set session cookie" error * Advisor with MySQL 8.0.3 and newer * Fix PHP deprecation errors * Fix a situation where exporting users after a delete query could remove users * Fix incorrect "You do not have privileges to manipulate with the users!" warning * Fix copying a database's privileges and several other problems moving columns with MariaDB * Fix for phpMyAdmin not selecting all the values when using shift-click to select during Export Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2599=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2599=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2019-2599=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-2599=1 Package List: - openSUSE Leap 15.1 (noarch): phpMyAdmin-4.9.2-lp151.2.9.1 - openSUSE Leap 15.0 (noarch): phpMyAdmin-4.9.2-lp150.37.1 - openSUSE Backports SLE-15-SP1 (noarch): phpMyAdmin-4.9.2-bp151.3.9.1 - openSUSE Backports SLE-15 (noarch): phpMyAdmin-4.9.2-bp150.37.1 References: https://www.suse.com/security/cve/CVE-2019-18622.html https://bugzilla.suse.com/1157614

1 0

openSUSE-SU-2019:2598-1: important: Security update for strongswan
by opensuse-security＠opensuse.org 01 Dec '19

01 Dec '19

openSUSE Security Update: Security update for strongswan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2598-1 Rating: important References: #1093536 #1094462 #1107874 #1109845 Cross-References: CVE-2018-10811 CVE-2018-16151 CVE-2018-16152 CVE-2018-17540 CVE-2018-5388 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for strongswan fixes the following issues: Security issues fixed: - CVE-2018-5388: Fixed a buffer underflow which may allow to a remote attacker with local user credentials to resource exhaustion and denial of service while reading from the socket (bsc#1094462). - CVE-2018-10811: Fixed a denial of service during the IKEv2 key derivation if the openssl plugin is used in FIPS mode and HMAC-MD5 is negotiated as PRF (bsc#1093536). - CVE-2018-16151,CVE-2018-16152: Fixed multiple flaws in the gmp plugin which might lead to authorization bypass (bsc#1107874). - CVE-2018-17540: Fixed an improper input validation in gmp plugin (bsc#1109845). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2598=1 Package List: - openSUSE Leap 15.1 (noarch): strongswan-doc-5.6.0-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): strongswan-5.6.0-lp151.4.3.1 strongswan-debuginfo-5.6.0-lp151.4.3.1 strongswan-debugsource-5.6.0-lp151.4.3.1 strongswan-hmac-5.6.0-lp151.4.3.1 strongswan-ipsec-5.6.0-lp151.4.3.1 strongswan-ipsec-debuginfo-5.6.0-lp151.4.3.1 strongswan-libs0-5.6.0-lp151.4.3.1 strongswan-libs0-debuginfo-5.6.0-lp151.4.3.1 strongswan-mysql-5.6.0-lp151.4.3.1 strongswan-mysql-debuginfo-5.6.0-lp151.4.3.1 strongswan-nm-5.6.0-lp151.4.3.1 strongswan-nm-debuginfo-5.6.0-lp151.4.3.1 strongswan-sqlite-5.6.0-lp151.4.3.1 strongswan-sqlite-debuginfo-5.6.0-lp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-10811.html https://www.suse.com/security/cve/CVE-2018-16151.html https://www.suse.com/security/cve/CVE-2018-16152.html https://www.suse.com/security/cve/CVE-2018-17540.html https://www.suse.com/security/cve/CVE-2018-5388.html https://bugzilla.suse.com/1093536 https://bugzilla.suse.com/1094462 https://bugzilla.suse.com/1107874 https://bugzilla.suse.com/1109845

1 0

openSUSE-SU-2019:2597-1: moderate: Security update for clamav
by opensuse-security＠opensuse.org 01 Dec '19

01 Dec '19

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2597-1 Rating: moderate References: #1144504 #1149458 #1151839 Cross-References: CVE-2019-12625 CVE-2019-12900 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for clamav fixes the following issues: Security issue fixed: - CVE-2019-12625: Fixed a ZIP bomb issue by adding detection and heuristics for zips with overlapping files (bsc#1144504). - CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors (bsc#1149458). Non-security issues fixed: - Added the --max-scantime clamscan option and MaxScanTime clamd configuration option (bsc#1144504). - Increased the startup timeout of clamd to 5 minutes to cater for the grown virus database as a workaround until clamd has learned to talk to systemd to extend the timeout as long as needed (bsc#1151839). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2597=1 Package List: - openSUSE Leap 15.0 (x86_64): clamav-0.100.3-lp150.2.13.1 clamav-debuginfo-0.100.3-lp150.2.13.1 clamav-debugsource-0.100.3-lp150.2.13.1 clamav-devel-0.100.3-lp150.2.13.1 libclamav7-0.100.3-lp150.2.13.1 libclamav7-debuginfo-0.100.3-lp150.2.13.1 libclammspack0-0.100.3-lp150.2.13.1 libclammspack0-debuginfo-0.100.3-lp150.2.13.1 References: https://www.suse.com/security/cve/CVE-2019-12625.html https://www.suse.com/security/cve/CVE-2019-12900.html https://bugzilla.suse.com/1144504 https://bugzilla.suse.com/1149458 https://bugzilla.suse.com/1151839

1 0