February 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:0185-1: moderate: Security update for rmt-server
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for rmt-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0185-1 Rating: moderate References: #1102046 #1102193 #1109307 #1113760 #1113969 #1114831 #1117106 #1118579 #1118584 Cross-References: CVE-2018-14404 CVE-2018-16468 CVE-2018-16470 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has 6 fixes is now available. Description: This update for rmt-server to version 1.1.1 fixes the following issues: The following issues have been fixed: - Fixed migration problems which caused some extensions / modules to be dropped (bsc#1118584, bsc#1118579) - Fixed listing of mirrored products (bsc#1102193) - Include online migration paths into offline migration (bsc#1117106) - Sync products that do not have a base product (bsc#1109307) - Fixed SLP auto discovery for RMT (bsc#1113760) Update dependencies for security fixes: - CVE-2018-16468: Update loofah to 2.2.3 (bsc#1113969) - CVE-2018-16470: Update rack to 2.0.6 (bsc#1114831) - CVE-2018-14404: Update nokogiri to 1.8.5 (bsc#1102046) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-185=1 Package List: - openSUSE Leap 15.0 (x86_64): rmt-server-1.1.1-lp150.2.12.1 rmt-server-debuginfo-1.1.1-lp150.2.12.1 rmt-server-pubcloud-1.1.1-lp150.2.12.1 References: https://www.suse.com/security/cve/CVE-2018-14404.html https://www.suse.com/security/cve/CVE-2018-16468.html https://www.suse.com/security/cve/CVE-2018-16470.html https://bugzilla.suse.com/1102046 https://bugzilla.suse.com/1102193 https://bugzilla.suse.com/1109307 https://bugzilla.suse.com/1113760 https://bugzilla.suse.com/1113969 https://bugzilla.suse.com/1114831 https://bugzilla.suse.com/1117106 https://bugzilla.suse.com/1118579 https://bugzilla.suse.com/1118584

1 0

openSUSE-SU-2019:0176-1: important: Security update for spice
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for spice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0176-1 Rating: important References: #1122706 Cross-References: CVE-2019-3813 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for spice fixes the following issues: Security issue fixed: - CVE-2019-3813: Fixed a out-of-bounds read in the memslot_get_virt function that could lead to denial-of-service or code-execution (bsc#1122706). This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-176=1 Package List: - openSUSE Leap 42.3 (x86_64): libspice-server-devel-0.12.8-13.1 libspice-server1-0.12.8-13.1 libspice-server1-debuginfo-0.12.8-13.1 spice-debugsource-0.12.8-13.1 References: https://www.suse.com/security/cve/CVE-2019-3813.html https://bugzilla.suse.com/1122706

1 0

openSUSE-RU-2019:0180-1: moderate: Recommended update for grub2
by maintenance＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Recommended Update: Recommended update for grub2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0180-1 Rating: moderate References: #1114754 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for grub2 fixes the following issues: - Fixed possible install media boot issues on certain hardware by changing default tsc calibration method to pmtimer on EFI. (bsc#1114754) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-180=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): grub2-2.02-lp150.13.16.1 grub2-branding-upstream-2.02-lp150.13.16.1 grub2-debuginfo-2.02-lp150.13.16.1 grub2-debugsource-2.02-lp150.13.16.1 grub2-i386-pc-2.02-lp150.13.16.1 - openSUSE Leap 15.0 (noarch): grub2-snapper-plugin-2.02-lp150.13.16.1 grub2-systemd-sleep-plugin-2.02-lp150.13.16.1 - openSUSE Leap 15.0 (x86_64): grub2-x86_64-efi-2.02-lp150.13.16.1 grub2-x86_64-xen-2.02-lp150.13.16.1 - openSUSE Leap 15.0 (i586): grub2-i386-efi-2.02-lp150.13.16.1 grub2-i386-xen-2.02-lp150.13.16.1 References: https://bugzilla.suse.com/1114754

1 0

openSUSE-RU-2019:0179-1: important: Recommended update for mariadb-connector-c
by maintenance＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Recommended Update: Recommended update for mariadb-connector-c ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0179-1 Rating: important References: #1097938 #1116686 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for mariadb-connector-c fixes the following issues: - Update to version 3.0.7 (bsc#1116686) - Fixed installation issue where libmysqlclient.so.18 link was missing (bsc#1097938). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-179=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libmariadb-devel-3.0.7-lp150.2.3.1 libmariadb-devel-debuginfo-3.0.7-lp150.2.3.1 libmariadb3-3.0.7-lp150.2.3.1 libmariadb3-debuginfo-3.0.7-lp150.2.3.1 libmariadb_plugins-3.0.7-lp150.2.3.1 libmariadb_plugins-debuginfo-3.0.7-lp150.2.3.1 libmariadbprivate-3.0.7-lp150.2.3.1 libmariadbprivate-debuginfo-3.0.7-lp150.2.3.1 mariadb-connector-c-debugsource-3.0.7-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libmariadb3-32bit-3.0.7-lp150.2.3.1 libmariadb3-32bit-debuginfo-3.0.7-lp150.2.3.1 References: https://bugzilla.suse.com/1097938 https://bugzilla.suse.com/1116686

1 0

openSUSE-SU-2019:0175-1: moderate: Security update for lua53
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for lua53 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0175-1 Rating: moderate References: #1123043 Cross-References: CVE-2019-6706 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lua53 fixes the following issues: Security issue fixed: - CVE-2019-6706: Fixed a use-after-free bug in the lua_upvaluejoin function of lapi.c (bsc#1123043) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-175=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): liblua5_3-5-5.3.4-lp150.2.3.1 liblua5_3-5-debuginfo-5.3.4-lp150.2.3.1 lua53-5.3.4-lp150.2.3.1 lua53-debuginfo-5.3.4-lp150.2.3.1 lua53-debugsource-5.3.4-lp150.2.3.1 lua53-devel-5.3.4-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): lua53-doc-5.3.4-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): liblua5_3-5-32bit-5.3.4-lp150.2.3.1 liblua5_3-5-32bit-debuginfo-5.3.4-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-6706.html https://bugzilla.suse.com/1123043

1 0

openSUSE-RU-2019:0177-1: moderate: Recommended update for trustedgrub2
by maintenance＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Recommended Update: Recommended update for trustedgrub2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0177-1 Rating: moderate References: #1052420 #1084632 #1100984 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for trustedgrub2 provides the following fixes: - Fix "no symbol table" error on new binutils. (bsc#1100984) - Fix packed-not-aligned error on GCC 8. (bsc#1084632) - Allow to execute menuentry unrestricted as default. (fate#318574, bsc#1052420) - Disable PIE building, as it does not make sense for bootloader. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-177=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): trustedgrub2-1.4.0-4.3.1 - openSUSE Leap 42.3 (noarch): trustedgrub2-i386-pc-1.4.0-4.3.1 References: https://bugzilla.suse.com/1052420 https://bugzilla.suse.com/1084632 https://bugzilla.suse.com/1100984

1 0

openSUSE-RU-2019:0178-1: moderate: Recommended update for glib2
by maintenance＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Recommended Update: Recommended update for glib2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0178-1 Rating: moderate References: #1090047 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for glib2 provides the following fix: - Enable systemtap. (fate#326393, bsc#1090047) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-178=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): glib2-debugsource-2.54.3-lp150.3.6.1 glib2-devel-2.54.3-lp150.3.6.1 glib2-devel-debuginfo-2.54.3-lp150.3.6.1 glib2-devel-static-2.54.3-lp150.3.6.1 glib2-tools-2.54.3-lp150.3.6.1 glib2-tools-debuginfo-2.54.3-lp150.3.6.1 libgio-2_0-0-2.54.3-lp150.3.6.1 libgio-2_0-0-debuginfo-2.54.3-lp150.3.6.1 libgio-fam-2.54.3-lp150.3.6.1 libgio-fam-debuginfo-2.54.3-lp150.3.6.1 libglib-2_0-0-2.54.3-lp150.3.6.1 libglib-2_0-0-debuginfo-2.54.3-lp150.3.6.1 libgmodule-2_0-0-2.54.3-lp150.3.6.1 libgmodule-2_0-0-debuginfo-2.54.3-lp150.3.6.1 libgobject-2_0-0-2.54.3-lp150.3.6.1 libgobject-2_0-0-debuginfo-2.54.3-lp150.3.6.1 libgthread-2_0-0-2.54.3-lp150.3.6.1 libgthread-2_0-0-debuginfo-2.54.3-lp150.3.6.1 - openSUSE Leap 15.0 (x86_64): glib2-devel-32bit-2.54.3-lp150.3.6.1 glib2-devel-32bit-debuginfo-2.54.3-lp150.3.6.1 glib2-tools-32bit-2.54.3-lp150.3.6.1 glib2-tools-32bit-debuginfo-2.54.3-lp150.3.6.1 libgio-2_0-0-32bit-2.54.3-lp150.3.6.1 libgio-2_0-0-32bit-debuginfo-2.54.3-lp150.3.6.1 libgio-fam-32bit-2.54.3-lp150.3.6.1 libgio-fam-32bit-debuginfo-2.54.3-lp150.3.6.1 libglib-2_0-0-32bit-2.54.3-lp150.3.6.1 libglib-2_0-0-32bit-debuginfo-2.54.3-lp150.3.6.1 libgmodule-2_0-0-32bit-2.54.3-lp150.3.6.1 libgmodule-2_0-0-32bit-debuginfo-2.54.3-lp150.3.6.1 libgobject-2_0-0-32bit-2.54.3-lp150.3.6.1 libgobject-2_0-0-32bit-debuginfo-2.54.3-lp150.3.6.1 libgthread-2_0-0-32bit-2.54.3-lp150.3.6.1 libgthread-2_0-0-32bit-debuginfo-2.54.3-lp150.3.6.1 - openSUSE Leap 15.0 (noarch): gio-branding-upstream-2.54.3-lp150.3.6.1 glib2-lang-2.54.3-lp150.3.6.1 References: https://bugzilla.suse.com/1090047

1 0

openSUSE-SU-2019:0174-1: important: Security update for curl
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0174-1 Rating: important References: #1123371 #1123377 #1123378 Cross-References: CVE-2018-16890 CVE-2019-3822 CVE-2019-3823 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for curl fixes the following issues: Security issues fixed: - CVE-2019-3823: Fixed a heap out-of-bounds read in the code handling the end-of-response for SMTP (bsc#1123378). - CVE-2019-3822: Fixed a stack based buffer overflow in the function creating an outgoing NTLM type-3 message (bsc#1123377). - CVE-2018-16890: Fixed a heap buffer out-of-bounds read in the function handling incoming NTLM type-2 messages (bsc#1123371). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-174=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): curl-7.60.0-lp150.2.18.1 curl-debuginfo-7.60.0-lp150.2.18.1 curl-debugsource-7.60.0-lp150.2.18.1 curl-mini-7.60.0-lp150.2.18.1 curl-mini-debuginfo-7.60.0-lp150.2.18.1 curl-mini-debugsource-7.60.0-lp150.2.18.1 libcurl-devel-7.60.0-lp150.2.18.1 libcurl-mini-devel-7.60.0-lp150.2.18.1 libcurl4-7.60.0-lp150.2.18.1 libcurl4-debuginfo-7.60.0-lp150.2.18.1 libcurl4-mini-7.60.0-lp150.2.18.1 libcurl4-mini-debuginfo-7.60.0-lp150.2.18.1 - openSUSE Leap 15.0 (x86_64): libcurl-devel-32bit-7.60.0-lp150.2.18.1 libcurl4-32bit-7.60.0-lp150.2.18.1 libcurl4-32bit-debuginfo-7.60.0-lp150.2.18.1 References: https://www.suse.com/security/cve/CVE-2018-16890.html https://www.suse.com/security/cve/CVE-2019-3822.html https://www.suse.com/security/cve/CVE-2019-3823.html https://bugzilla.suse.com/1123371 https://bugzilla.suse.com/1123377 https://bugzilla.suse.com/1123378

1 0

openSUSE-RU-2019:0181-1: moderate: Recommended update for gtk3
by maintenance＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Recommended Update: Recommended update for gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0181-1 Rating: moderate References: #1119306 #1121456 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for gtk3 fixes the following issues: - Add support for AtkTableCell. (bsc#1119306, fate#326548) - Export gtk_cell_accessible_parent_get_(row|column)_header_cells_ functions. (bsc#1121456) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-181=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): gettext-its-gtk3-3.22.30-lp150.3.6.1 gtk3-debugsource-3.22.30-lp150.3.6.1 gtk3-devel-3.22.30-lp150.3.6.1 gtk3-devel-debuginfo-3.22.30-lp150.3.6.1 gtk3-immodule-amharic-3.22.30-lp150.3.6.1 gtk3-immodule-amharic-debuginfo-3.22.30-lp150.3.6.1 gtk3-immodule-broadway-3.22.30-lp150.3.6.1 gtk3-immodule-broadway-debuginfo-3.22.30-lp150.3.6.1 gtk3-immodule-inuktitut-3.22.30-lp150.3.6.1 gtk3-immodule-inuktitut-debuginfo-3.22.30-lp150.3.6.1 gtk3-immodule-multipress-3.22.30-lp150.3.6.1 gtk3-immodule-multipress-debuginfo-3.22.30-lp150.3.6.1 gtk3-immodule-thai-3.22.30-lp150.3.6.1 gtk3-immodule-thai-debuginfo-3.22.30-lp150.3.6.1 gtk3-immodule-vietnamese-3.22.30-lp150.3.6.1 gtk3-immodule-vietnamese-debuginfo-3.22.30-lp150.3.6.1 gtk3-immodule-xim-3.22.30-lp150.3.6.1 gtk3-immodule-xim-debuginfo-3.22.30-lp150.3.6.1 gtk3-immodules-tigrigna-3.22.30-lp150.3.6.1 gtk3-immodules-tigrigna-debuginfo-3.22.30-lp150.3.6.1 gtk3-tools-3.22.30-lp150.3.6.1 gtk3-tools-debuginfo-3.22.30-lp150.3.6.1 libgtk-3-0-3.22.30-lp150.3.6.1 libgtk-3-0-debuginfo-3.22.30-lp150.3.6.1 typelib-1_0-Gtk-3_0-3.22.30-lp150.3.6.1 - openSUSE Leap 15.0 (noarch): gtk3-branding-upstream-3.22.30-lp150.3.6.1 gtk3-data-3.22.30-lp150.3.6.1 gtk3-lang-3.22.30-lp150.3.6.1 gtk3-schema-3.22.30-lp150.3.6.1 - openSUSE Leap 15.0 (x86_64): gtk3-devel-32bit-3.22.30-lp150.3.6.1 gtk3-devel-32bit-debuginfo-3.22.30-lp150.3.6.1 gtk3-immodule-amharic-32bit-3.22.30-lp150.3.6.1 gtk3-immodule-amharic-32bit-debuginfo-3.22.30-lp150.3.6.1 gtk3-immodule-inuktitut-32bit-3.22.30-lp150.3.6.1 gtk3-immodule-inuktitut-32bit-debuginfo-3.22.30-lp150.3.6.1 gtk3-immodule-multipress-32bit-3.22.30-lp150.3.6.1 gtk3-immodule-multipress-32bit-debuginfo-3.22.30-lp150.3.6.1 gtk3-immodule-thai-32bit-3.22.30-lp150.3.6.1 gtk3-immodule-thai-32bit-debuginfo-3.22.30-lp150.3.6.1 gtk3-immodule-vietnamese-32bit-3.22.30-lp150.3.6.1 gtk3-immodule-vietnamese-32bit-debuginfo-3.22.30-lp150.3.6.1 gtk3-immodule-xim-32bit-3.22.30-lp150.3.6.1 gtk3-immodule-xim-32bit-debuginfo-3.22.30-lp150.3.6.1 gtk3-immodules-tigrigna-32bit-3.22.30-lp150.3.6.1 gtk3-immodules-tigrigna-32bit-debuginfo-3.22.30-lp150.3.6.1 gtk3-tools-32bit-3.22.30-lp150.3.6.1 gtk3-tools-32bit-debuginfo-3.22.30-lp150.3.6.1 libgtk-3-0-32bit-3.22.30-lp150.3.6.1 libgtk-3-0-32bit-debuginfo-3.22.30-lp150.3.6.1 References: https://bugzilla.suse.com/1119306 https://bugzilla.suse.com/1121456

1 0

openSUSE-SU-2019:0173-1: important: Security update for curl
by opensuse-security＠opensuse.org 14 Feb '19

14 Feb '19

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0173-1 Rating: important References: #1123371 #1123377 #1123378 Cross-References: CVE-2018-16890 CVE-2019-3822 CVE-2019-3823 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for curl fixes the following issues: Security issues fixed: - CVE-2019-3823: Fixed a heap out-of-bounds read in the code handling the end-of-response for SMTP (bsc#1123378). - CVE-2019-3822: Fixed a stack based buffer overflow in the function creating an outgoing NTLM type-3 message (bsc#1123377). - CVE-2018-16890: Fixed a heap buffer out-of-bounds read in the function handling incoming NTLM type-2 messages (bsc#1123371). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-173=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): curl-7.37.0-45.1 curl-debuginfo-7.37.0-45.1 curl-debugsource-7.37.0-45.1 libcurl-devel-7.37.0-45.1 libcurl4-7.37.0-45.1 libcurl4-debuginfo-7.37.0-45.1 - openSUSE Leap 42.3 (x86_64): libcurl-devel-32bit-7.37.0-45.1 libcurl4-32bit-7.37.0-45.1 libcurl4-debuginfo-32bit-7.37.0-45.1 References: https://www.suse.com/security/cve/CVE-2018-16890.html https://www.suse.com/security/cve/CVE-2019-3822.html https://www.suse.com/security/cve/CVE-2019-3823.html https://bugzilla.suse.com/1123371 https://bugzilla.suse.com/1123377 https://bugzilla.suse.com/1123378

1 0