February 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2019:0263-1: moderate: Recommended update for python-azure-agent
by maintenance＠opensuse.org 27 Feb '19

27 Feb '19

openSUSE Recommended Update: Recommended update for python-azure-agent ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0263-1 Rating: moderate References: #1094420 #1119542 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for python-azure-agent fixes the following issues: python-azure-agent was updated to 2.2.36 (bsc#1119542) + [#1451] Do not utf-8 encode telemetry messages + [#1434] Use files instead of pipes to capture stdout/stderr + [#1431] Prevent multiple downloads of zips + [#1418] Add main module to Python's egg + [#1416] Fix UTF-8 encoding for telemetry payload + [#1408] Honor the 'no_proxy' flag + [#1391, #1401, #1441] Azure Stack improvements + [#1384] Write status file in WALinuxAgent lib folder + [#1375] Add support for Redhat + [#1373] Handle different kernel builds on SUSE Linux Enterprise + [#1365, #1385, #1389] Fixes for RDMA + [#1397] Send events when extensions fail to complete operation + [#1394/#1366] Fix the threshold telemetry issue + [#1298] Implementing extension sequencing in azure Linux agent + [#1340] Allow Clear Linux detection in python2 and python3 + [#1345] FreeBSD swap issues fix (#1144) + [#1349] Use append_file in Redhat6xOSUtil.openssl_to_openssh() + [#1355] Ensure 'value' for authorized ssh keys end in "\n" + [#1361] Remove main module + [#1325] Enable cgroups by default on all distros + [#1327, #1347] Allow enforcing of cgroups limits + [#1337] Allow configuration for cgroups + [#1333] Add support for NSBSD + [#1319] Stream extension downloads to disk (do not buffer the download in memory) + [#1303] Fix to support custom DNS servers + [#1306] Log extension stdout and stderr + [#1302] Better of cloud-init configuration during deprovisioning + [#1295] Fix to report the correct extension error code + [#1289] Allow disabling the agent or extensions + [#1290] Use the "ip route" command instead of the "route" comand during network configuration + [#1281] Delete JIT accounts + [#1234] Fix for reading KVP values from host + [#1287] Add UDEV rule in azure disk encryption + [#1196] Health store integration + [#1199] CGroups support + [#1194] Use host for status reporting + [#1188] Fix for sentinel and signal handlers + [#1182] Telemetry updates + [#1171] Add support for JIT + [#1164] Fix for name resolution in Ubuntu 18.04 + [#1154] Set connection close header + [#1143] Remove extension packages after extraction + Revert extension manifest caching to prevent downgrade issues. + [#929] wire.py#update_goal_state does not handle out-of-date GoalState errors + [#908] Set Files to 0400 in /var/lib/waagent + [#906] Hardcoded value for sshd's ClientAliveInterval (180) + [#899] Improve HeartBeat Event + [#898] Send dummy status if extension fails to write a #.status file + [#897] 'Target handler state' wall of errors + [#896] End of Line Comments are Not Supported nor Handled + [#891] Create a Telemetry Event to Track Custom Data Execution + [#884] Cleanup Old Goal State and Extension Cache + [#876] The agent should use a scaling back-off when retrying HTTP requests + [#869] The agent should report OS information in the correct JSON format. + [#822] Update docs This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-263=1 Package List: - openSUSE Leap 15.0 (noarch): python-azure-agent-2.2.36-lp150.5.6.1 python-azure-agent-test-2.2.36-lp150.5.6.1 References: https://bugzilla.suse.com/1094420 https://bugzilla.suse.com/1119542

1 0

openSUSE-SU-2019:0252-1: important: Security update for docker-runc
by opensuse-security＠opensuse.org 27 Feb '19

27 Feb '19

openSUSE Security Update: Security update for docker-runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0252-1 Rating: important References: #1121967 Cross-References: CVE-2019-5736 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for docker-runc fixes the following issues: Security issue fixed: - CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-252=1 Package List: - openSUSE Leap 15.0 (noarch): docker-runc-test-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.7.1 - openSUSE Leap 15.0 (x86_64): docker-runc-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.7.1 docker-runc-debuginfo-1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.7.1 References: https://www.suse.com/security/cve/CVE-2019-5736.html https://bugzilla.suse.com/1121967

1 0

openSUSE-SU-2019:0255-1: important: Security update for systemd
by opensuse-security＠opensuse.org 27 Feb '19

27 Feb '19

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0255-1 Rating: important References: #1117025 #1121563 #1122000 #1123333 #1123727 #1123892 #1124153 #1125352 Cross-References: CVE-2019-6454 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves one vulnerability and has 7 fixes is now available. Description: This update for systemd fixes the following issues: - CVE-2019-6454: Overlong DBUS messages could be used to crash systemd (bsc#1125352) - units: make sure initrd-cleanup.service terminates before switching to rootfs (bsc#1123333) - logind: fix bad error propagation - login: log session state "closing" (as well as New/Removed) - logind: fix borked r check - login: don't remove all devices from PID1 when only one was removed - login: we only allow opening character devices - login: correct comment in session_device_free() - login: remember that fds received from PID1 need to be removed eventually - login: fix FDNAME in call to sd_pid_notify_with_fds() - logind: fd 0 is a valid fd - logind: rework sd_eviocrevoke() - logind: check file is device node before using .st_rdev - logind: use the new FDSTOREREMOVE=1 sd_notify() message (bsc#1124153) - core: add a new sd_notify() message for removing fds from the FD store again - logind: make sure we don't trip up on half-initialized session devices (bsc#1123727) - fd-util: accept that kcmp might fail with EPERM/EACCES - core: Fix use after free case in load_from_path() (bsc#1121563) - core: include Found state in device dumps - device: fix serialization and deserialization of DeviceFound - fix path in btrfs rule (#6844) - assemble multidevice btrfs volumes without external tools (#6607) (bsc#1117025) - Update systemd-system.conf.xml (bsc#1122000) - units: inform user that the default target is started after exiting from rescue or emergency mode - core: free lines after reading them (bsc#1123892) - sd-bus: if we receive an invalid dbus message, ignore and proceeed - automount: don't pass non-blocking pipe to kernel. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-255=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libsystemd0-234-lp150.20.15.1 libsystemd0-debuginfo-234-lp150.20.15.1 libsystemd0-mini-234-lp150.20.15.1 libsystemd0-mini-debuginfo-234-lp150.20.15.1 libudev-devel-234-lp150.20.15.1 libudev-mini-devel-234-lp150.20.15.1 libudev-mini1-234-lp150.20.15.1 libudev-mini1-debuginfo-234-lp150.20.15.1 libudev1-234-lp150.20.15.1 libudev1-debuginfo-234-lp150.20.15.1 nss-myhostname-234-lp150.20.15.1 nss-myhostname-debuginfo-234-lp150.20.15.1 nss-mymachines-234-lp150.20.15.1 nss-mymachines-debuginfo-234-lp150.20.15.1 nss-systemd-234-lp150.20.15.1 nss-systemd-debuginfo-234-lp150.20.15.1 systemd-234-lp150.20.15.1 systemd-container-234-lp150.20.15.1 systemd-container-debuginfo-234-lp150.20.15.1 systemd-coredump-234-lp150.20.15.1 systemd-coredump-debuginfo-234-lp150.20.15.1 systemd-debuginfo-234-lp150.20.15.1 systemd-debugsource-234-lp150.20.15.1 systemd-devel-234-lp150.20.15.1 systemd-logger-234-lp150.20.15.1 systemd-mini-234-lp150.20.15.1 systemd-mini-container-mini-234-lp150.20.15.1 systemd-mini-container-mini-debuginfo-234-lp150.20.15.1 systemd-mini-coredump-mini-234-lp150.20.15.1 systemd-mini-coredump-mini-debuginfo-234-lp150.20.15.1 systemd-mini-debuginfo-234-lp150.20.15.1 systemd-mini-debugsource-234-lp150.20.15.1 systemd-mini-devel-234-lp150.20.15.1 systemd-mini-sysvinit-234-lp150.20.15.1 systemd-sysvinit-234-lp150.20.15.1 udev-234-lp150.20.15.1 udev-debuginfo-234-lp150.20.15.1 udev-mini-234-lp150.20.15.1 udev-mini-debuginfo-234-lp150.20.15.1 - openSUSE Leap 15.0 (noarch): systemd-bash-completion-234-lp150.20.15.1 systemd-mini-bash-completion-234-lp150.20.15.1 - openSUSE Leap 15.0 (x86_64): libsystemd0-32bit-234-lp150.20.15.1 libsystemd0-32bit-debuginfo-234-lp150.20.15.1 libudev-devel-32bit-234-lp150.20.15.1 libudev1-32bit-234-lp150.20.15.1 libudev1-32bit-debuginfo-234-lp150.20.15.1 nss-myhostname-32bit-234-lp150.20.15.1 nss-myhostname-32bit-debuginfo-234-lp150.20.15.1 nss-mymachines-32bit-234-lp150.20.15.1 nss-mymachines-32bit-debuginfo-234-lp150.20.15.1 systemd-32bit-234-lp150.20.15.1 systemd-32bit-debuginfo-234-lp150.20.15.1 References: https://www.suse.com/security/cve/CVE-2019-6454.html https://bugzilla.suse.com/1117025 https://bugzilla.suse.com/1121563 https://bugzilla.suse.com/1122000 https://bugzilla.suse.com/1123333 https://bugzilla.suse.com/1123727 https://bugzilla.suse.com/1123892 https://bugzilla.suse.com/1124153 https://bugzilla.suse.com/1125352

1 0

openSUSE-RU-2019:0264-1: moderate: Recommended update for wicked
by maintenance＠opensuse.org 27 Feb '19

27 Feb '19

openSUSE Recommended Update: Recommended update for wicked ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0264-1 Rating: moderate References: #1118378 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for wicked fixes the following issues: - Wicked test command now displays the hostname. (bsc#1118378) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-264=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libwicked-0-6-0.6.53-lp150.2.6.1 libwicked-0-6-debuginfo-0.6.53-lp150.2.6.1 wicked-0.6.53-lp150.2.6.1 wicked-debuginfo-0.6.53-lp150.2.6.1 wicked-debugsource-0.6.53-lp150.2.6.1 wicked-service-0.6.53-lp150.2.6.1 References: https://bugzilla.suse.com/1118378

1 0

openSUSE-RU-2019:0258-1: moderate: Recommended update for mutter
by maintenance＠opensuse.org 27 Feb '19

27 Feb '19

openSUSE Recommended Update: Recommended update for mutter ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0258-1 Rating: moderate References: #1120372 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mutter provides the following fixes: - When a Wayland client issues a shortcut inhibit request which is granted by the user, the Super key should be passed to the surface instead of being handled by the compositor (bsc#1120372) - Make mutter exit instead of crash if Xwayland goes away unexpectedly. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-258=1 Package List: - openSUSE Leap 15.0 (noarch): mutter-lang-3.26.2+20180207.4b2d21ff0-lp150.4.6.1 - openSUSE Leap 15.0 (x86_64): libmutter-1-0-3.26.2+20180207.4b2d21ff0-lp150.4.6.1 libmutter-1-0-debuginfo-3.26.2+20180207.4b2d21ff0-lp150.4.6.1 mutter-3.26.2+20180207.4b2d21ff0-lp150.4.6.1 mutter-data-3.26.2+20180207.4b2d21ff0-lp150.4.6.1 mutter-debuginfo-3.26.2+20180207.4b2d21ff0-lp150.4.6.1 mutter-debugsource-3.26.2+20180207.4b2d21ff0-lp150.4.6.1 mutter-devel-3.26.2+20180207.4b2d21ff0-lp150.4.6.1 References: https://bugzilla.suse.com/1120372

1 0

openSUSE-SU-2019:0251-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 27 Feb '19

27 Feb '19

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0251-1 Rating: important References: #1119105 #1122983 #1125330 Cross-References: CVE-2016-5824 CVE-2018-12405 CVE-2018-17466 CVE-2018-18335 CVE-2018-18356 CVE-2018-18492 CVE-2018-18493 CVE-2018-18494 CVE-2018-18498 CVE-2018-18500 CVE-2018-18501 CVE-2018-18505 CVE-2018-18509 CVE-2019-5785 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 60.5.1 fixes the following issues: Security vulnerabilities addressed (MSFA 2019-03 MSFA 2018-31 MFSA 2019-06 bsc#1122983 bsc#1119105 bsc#1125330): - CVE-2018-18356: Fixed a Use-after-free in Skia. - CVE-2019-5785: Fixed an Integer overflow in Skia. - CVE-2018-18335: Fixed a Buffer overflow in Skia by default deactivating Canvas 2D. This issue does not affect Linuc distributions. - CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures showing mistekenly that emails bring a valid sugnature. - CVE-2018-18500: Use-after-free parsing HTML5 stream - CVE-2018-18505: Privilege escalation through IPC channel messages - CVE-2016-5824 DoS (use-after-free) via a crafted ics file - CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 - CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11 - CVE-2018-18492: Use-after-free with select element - CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia - CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs - CVE-2018-18498: Integer overflow when calculating buffer sizes for images - CVE-2018-12405: Memory safety bugs fixed in Firefox 64, 60.4, and Thunderbird 60.4 Other bug fixes and changes: - FileLink provider WeTransfer to upload large attachments - Thunderbird now allows the addition of OpenSearch search engines from a local XML file using a minimal user interface: [+] button to select a file an add, [-] to remove. - More search engines: Google and DuckDuckGo available by default in some locales - During account creation, Thunderbird will now detect servers using the Microsoft Exchange protocol. It will offer the installation of a 3rd party add-on (Owl) which supports that protocol. - Thunderbird now compatible with other WebExtension-based FileLink add-ons like the Dropbox add-on - New WebExtensions FileLink API to facilitate add-ons - Fix decoding problems for messages with less common charsets (cp932, cp936) - New messages in the drafts folder (and other special or virtual folders) will no longer be included in the new messages notification - Thunderbird 60 will migrate security databases (key3.db, cert8.db to key4.db, cert9.db). - Address book search and auto-complete slowness - Plain text markup with * for bold, / for italics, _ for underline and | for code did not work when the enclosed text contained non-ASCII characters - While composing a message, a link not removed when link location was removed in the link properties panel - Encoding problems when exporting address books or messages using the system charset. Messages are now always exported using the UTF-8 encoding - If the "Date" header of a message was invalid, Jan 1970 or Dec 1969 was displayed. Now using date from "Received" header instead. - Body search/filtering didn't reliably ignore content of tags - Inappropriate warning "Thunderbird prevented the site (addons.thunderbird.net) from asking you to install software on your computer" when installing add-ons - Incorrect display of correspondents column since own email address was not always detected - Spurious 
 (encoded newline) inserted into drafts and sent email - Double-clicking on a word in the Write window sometimes launched the Advanced Property Editor or Link Properties dialog - Fixed Cookie removal - "Download rest of message" was not working if global inbox was used - Fix Encoding problems for users (especially in Poland) when a file was sent via a folder using "Sent to > Mail recipient" due to a problem in the Thunderbird MAPI interface - According to RFC 4616 and RFC 5721, passwords containing non-ASCII characters are encoded using UTF-8 which can lead to problems with non-compliant providers, for example office365.com. The SMTP LOGIN and POP3 USER/PASS authentication methods are now using a Latin-1 encoding again to work around this issue - Fix shutdown crash/hang after entering an empty IMAP password This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-251=1 Package List: - openSUSE Leap 15.0 (x86_64): MozillaThunderbird-60.5.1-lp150.3.30.1 MozillaThunderbird-buildsymbols-60.5.1-lp150.3.30.1 MozillaThunderbird-debuginfo-60.5.1-lp150.3.30.1 MozillaThunderbird-debugsource-60.5.1-lp150.3.30.1 MozillaThunderbird-translations-common-60.5.1-lp150.3.30.1 MozillaThunderbird-translations-other-60.5.1-lp150.3.30.1 References: https://www.suse.com/security/cve/CVE-2016-5824.html https://www.suse.com/security/cve/CVE-2018-12405.html https://www.suse.com/security/cve/CVE-2018-17466.html https://www.suse.com/security/cve/CVE-2018-18335.html https://www.suse.com/security/cve/CVE-2018-18356.html https://www.suse.com/security/cve/CVE-2018-18492.html https://www.suse.com/security/cve/CVE-2018-18493.html https://www.suse.com/security/cve/CVE-2018-18494.html https://www.suse.com/security/cve/CVE-2018-18498.html https://www.suse.com/security/cve/CVE-2018-18500.html https://www.suse.com/security/cve/CVE-2018-18501.html https://www.suse.com/security/cve/CVE-2018-18505.html https://www.suse.com/security/cve/CVE-2018-18509.html https://www.suse.com/security/cve/CVE-2019-5785.html https://bugzilla.suse.com/1119105 https://bugzilla.suse.com/1122983 https://bugzilla.suse.com/1125330

1 0

openSUSE-RU-2019:0256-1: moderate: Recommended update for libqt5-qtdeclarative
by maintenance＠opensuse.org 27 Feb '19

27 Feb '19

openSUSE Recommended Update: Recommended update for libqt5-qtdeclarative ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0256-1 Rating: moderate References: #1114570 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libqt5-qtdeclarative provides the following fix: - Fix various issues with the JS/QML Date object. (bsc#1114570) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-256=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libQtQuick5-5.9.4-lp150.2.3.1 libQtQuick5-debuginfo-5.9.4-lp150.2.3.1 libqt5-qtdeclarative-debugsource-5.9.4-lp150.2.3.1 libqt5-qtdeclarative-devel-5.9.4-lp150.2.3.1 libqt5-qtdeclarative-devel-debuginfo-5.9.4-lp150.2.3.1 libqt5-qtdeclarative-examples-5.9.4-lp150.2.3.1 libqt5-qtdeclarative-examples-debuginfo-5.9.4-lp150.2.3.1 libqt5-qtdeclarative-tools-5.9.4-lp150.2.3.1 libqt5-qtdeclarative-tools-debuginfo-5.9.4-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libQtQuick5-32bit-5.9.4-lp150.2.3.1 libQtQuick5-32bit-debuginfo-5.9.4-lp150.2.3.1 libqt5-qtdeclarative-devel-32bit-5.9.4-lp150.2.3.1 libqt5-qtdeclarative-devel-32bit-debuginfo-5.9.4-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): libqt5-qtdeclarative-private-headers-devel-5.9.4-lp150.2.3.1 References: https://bugzilla.suse.com/1114570

1 0

openSUSE-RU-2019:0253-1: moderate: Recommended update for texlive-specs-n
by maintenance＠opensuse.org 27 Feb '19

27 Feb '19

openSUSE Recommended Update: Recommended update for texlive-specs-n ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0253-1 Rating: moderate References: #1118796 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for texlive-specs-n provides the following fix: - Fix one more unescaped left brace with perl. (bsc#1118796) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-253=1 Package List: - openSUSE Leap 15.0 (noarch): texlive-latex-notes-zh-cn-2017.137.1.20svn15878-lp150.5.6.1 texlive-latex-papersize-2017.137.1.62svn42296-lp150.5.6.1 texlive-latex-papersize-doc-2017.137.1.62svn42296-lp150.5.6.1 texlive-latex-referenz-2017.137.2svn36671-lp150.5.6.1 texlive-latex-tabellen-2017.137.svn16979-lp150.5.6.1 texlive-latex-tds-2017.137.svn40613-lp150.5.6.1 texlive-latex-tds-doc-2017.137.svn40613-lp150.5.6.1 texlive-latex-veryshortguide-2017.137.svn41844-lp150.5.6.1 texlive-latex-web-companion-2017.137.svn29349-lp150.5.6.1 texlive-latex2e-help-texinfo-2017.137.svn38709-lp150.5.6.1 texlive-latex2e-help-texinfo-fr-2017.137.svn42541-lp150.5.6.1 texlive-latex2e-help-texinfo-spanish-2017.137.svn37356-lp150.5.6.1 texlive-latex2man-2017.137.1.25svn43855-lp150.5.6.1 texlive-latex2man-doc-2017.137.1.25svn43855-lp150.5.6.1 texlive-latex2nemeth-2017.137.1.0svn42300-lp150.5.6.1 texlive-latex2nemeth-doc-2017.137.1.0svn42300-lp150.5.6.1 texlive-latex4wp-2017.137.1.0.10svn35999-lp150.5.6.1 texlive-latex4wp-it-2017.137.1.0.10svn36000-lp150.5.6.1 texlive-latexbangla-2017.137.0.0.2svn42409-lp150.5.6.1 texlive-latexbangla-doc-2017.137.0.0.2svn42409-lp150.5.6.1 texlive-latexbug-2017.137.1.0asvn44566-lp150.5.6.1 texlive-latexbug-doc-2017.137.1.0asvn44566-lp150.5.6.1 texlive-latexcheat-2017.137.1.13svn15878-lp150.5.6.1 texlive-latexcheat-de-2017.137.svn35702-lp150.5.6.1 texlive-latexcheat-esmx-2017.137.2.00svn36866-lp150.5.6.1 texlive-latexcheat-ptbr-2017.137.1.13svn15878-lp150.5.6.1 texlive-latexconfig-2017.137.svn40274-lp150.5.6.1 texlive-latexcourse-rug-2017.137.1.1svn39026-lp150.5.6.1 texlive-latexdemo-2017.137.0.0.1svn34481-lp150.5.6.1 texlive-latexdemo-doc-2017.137.0.0.1svn34481-lp150.5.6.1 texlive-latexdiff-2017.137.1.2.0svn41892-lp150.5.6.1 texlive-latexdiff-doc-2017.137.1.2.0svn41892-lp150.5.6.1 texlive-latexfileinfo-pkgs-2017.137.0.0.22svn26760-lp150.5.6.1 texlive-latexfileinfo-pkgs-doc-2017.137.0.0.22svn26760-lp150.5.6.1 texlive-latexfileversion-2017.137.0.0.3svn29349-lp150.5.6.1 texlive-latexfileversion-doc-2017.137.0.0.3svn29349-lp150.5.6.1 texlive-latexgit-2017.137.svn41920-lp150.5.6.1 texlive-latexgit-doc-2017.137.svn41920-lp150.5.6.1 texlive-latexindent-2017.137.3.1svn44492-lp150.5.6.1 texlive-latexindent-doc-2017.137.3.1svn44492-lp150.5.6.1 texlive-latexmk-2017.137.4.52csvn43099-lp150.5.6.1 texlive-latexmk-doc-2017.137.4.52csvn43099-lp150.5.6.1 texlive-latexmp-2017.137.1.2.1svn15878-lp150.5.6.1 texlive-latexmp-doc-2017.137.1.2.1svn15878-lp150.5.6.1 texlive-latexpand-2017.137.1.3svn41873-lp150.5.6.1 texlive-latexpand-doc-2017.137.1.3svn41873-lp150.5.6.1 texlive-lato-2017.137.2.2svn24986-lp150.5.6.1 texlive-lato-doc-2017.137.2.2svn24986-lp150.5.6.1 texlive-lato-fonts-2017.137.2.2svn24986-lp150.5.6.1 texlive-layaureo-2017.137.0.0.2svn19087-lp150.5.6.1 texlive-layaureo-doc-2017.137.0.0.2svn19087-lp150.5.6.1 texlive-layouts-2017.137.2.6dsvn42428-lp150.5.6.1 texlive-layouts-doc-2017.137.2.6dsvn42428-lp150.5.6.1 texlive-lazylist-2017.137.1.0asvn17691-lp150.5.6.1 texlive-lazylist-doc-2017.137.1.0asvn17691-lp150.5.6.1 texlive-lcd-2017.137.0.0.3svn16549-lp150.5.6.1 texlive-lcd-doc-2017.137.0.0.3svn16549-lp150.5.6.1 texlive-lcdftypetools-2017.137.svn44166-lp150.5.6.1 texlive-lcg-2017.137.1.3svn31474-lp150.5.6.1 texlive-lcg-doc-2017.137.1.3svn31474-lp150.5.6.1 texlive-lcyw-2017.137.1.1svn15878-lp150.5.6.1 texlive-lcyw-doc-2017.137.1.1svn15878-lp150.5.6.1 texlive-leading-2017.137.0.0.3svn15878-lp150.5.6.1 texlive-leading-doc-2017.137.0.0.3svn15878-lp150.5.6.1 texlive-leadsheets-2017.137.0.0.5asvn43034-lp150.5.6.1 texlive-leadsheets-doc-2017.137.0.0.5asvn43034-lp150.5.6.1 texlive-leaflet-2017.137.1.1bsvn43523-lp150.5.6.1 texlive-leaflet-doc-2017.137.1.1bsvn43523-lp150.5.6.1 texlive-lecturer-2017.137.svn23916-lp150.5.6.1 texlive-lecturer-doc-2017.137.svn23916-lp150.5.6.1 texlive-ledmac-2017.137.0.0.19.4svn41811-lp150.5.6.1 texlive-ledmac-doc-2017.137.0.0.19.4svn41811-lp150.5.6.1 texlive-leftidx-2017.137.svn15878-lp150.5.6.1 texlive-leftidx-doc-2017.137.svn15878-lp150.5.6.1 texlive-leipzig-2017.137.1.1svn34902-lp150.5.6.1 texlive-leipzig-doc-2017.137.1.1svn34902-lp150.5.6.1 texlive-lengthconvert-2017.137.1.0asvn30867-lp150.5.6.1 texlive-lengthconvert-doc-2017.137.1.0asvn30867-lp150.5.6.1 texlive-lettre-2017.137.2.353svn35145-lp150.5.6.1 texlive-lettre-doc-2017.137.2.353svn35145-lp150.5.6.1 texlive-lettrine-2017.137.1.9svn38268-lp150.5.6.1 texlive-lettrine-doc-2017.137.1.9svn38268-lp150.5.6.1 texlive-levy-2017.137.svn21750-lp150.5.6.1 texlive-levy-doc-2017.137.svn21750-lp150.5.6.1 texlive-lewis-2017.137.0.0.1svn15878-lp150.5.6.1 texlive-lewis-doc-2017.137.0.0.1svn15878-lp150.5.6.1 texlive-lexikon-2017.137.1.0csvn17364-lp150.5.6.1 texlive-lexikon-doc-2017.137.1.0csvn17364-lp150.5.6.1 texlive-lexref-2017.137.1.1asvn36026-lp150.5.6.1 texlive-lexref-doc-2017.137.1.1asvn36026-lp150.5.6.1 texlive-lfb-2017.137.1.0svn15878-lp150.5.6.1 texlive-lfb-doc-2017.137.1.0svn15878-lp150.5.6.1 texlive-lgreek-2017.137.svn21818-lp150.5.6.1 texlive-lgreek-doc-2017.137.svn21818-lp150.5.6.1 texlive-lh-2017.137.3.5gsvn15878-lp150.5.6.1 texlive-lh-doc-2017.137.3.5gsvn15878-lp150.5.6.1 texlive-lhcyr-2017.137.svn31795-lp150.5.6.1 texlive-lhelp-2017.137.2.0svn23638-lp150.5.6.1 texlive-lhelp-doc-2017.137.2.0svn23638-lp150.5.6.1 texlive-libertine-2017.137.5.3.0svn43603-lp150.5.6.1 texlive-libertine-doc-2017.137.5.3.0svn43603-lp150.5.6.1 texlive-libertine-fonts-2017.137.5.3.0svn43603-lp150.5.6.1 texlive-libertinegc-2017.137.1.00svn39746-lp150.5.6.1 texlive-libertinegc-doc-2017.137.1.00svn39746-lp150.5.6.1 texlive-libertinus-2017.137.6.4svn44409-lp150.5.6.1 texlive-libertinus-doc-2017.137.6.4svn44409-lp150.5.6.1 texlive-libertinus-fonts-2017.137.6.4svn44409-lp150.5.6.1 texlive-libertinust1math-2017.137.1.0.4svn44542-lp150.5.6.1 texlive-libertinust1math-doc-2017.137.1.0.4svn44542-lp150.5.6.1 texlive-libertinust1math-fonts-2017.137.1.0.4svn44542-lp150.5.6.1 texlive-libgreek-2017.137.1.0svn27789-lp150.5.6.1 texlive-libgreek-doc-2017.137.1.0svn27789-lp150.5.6.1 texlive-librarian-2017.137.1.0svn19880-lp150.5.6.1 texlive-librarian-doc-2017.137.1.0svn19880-lp150.5.6.1 texlive-librebaskerville-2017.137.svn31741-lp150.5.6.1 texlive-librebaskerville-doc-2017.137.svn31741-lp150.5.6.1 texlive-librebaskerville-fonts-2017.137.svn31741-lp150.5.6.1 texlive-librebodoni-2017.137.svn39375-lp150.5.6.1 texlive-librebodoni-doc-2017.137.svn39375-lp150.5.6.1 texlive-librebodoni-fonts-2017.137.svn39375-lp150.5.6.1 texlive-librecaslon-2017.137.svn31929-lp150.5.6.1 texlive-librecaslon-doc-2017.137.svn31929-lp150.5.6.1 texlive-librecaslon-fonts-2017.137.svn31929-lp150.5.6.1 texlive-libris-2017.137.1.007svn19409-lp150.5.6.1 texlive-libris-doc-2017.137.1.007svn19409-lp150.5.6.1 texlive-libris-fonts-2017.137.1.007svn19409-lp150.5.6.1 texlive-lilyglyphs-2017.137.0.0.2.3svn33164-lp150.5.6.1 texlive-lilyglyphs-doc-2017.137.0.0.2.3svn33164-lp150.5.6.1 texlive-lilyglyphs-fonts-2017.137.0.0.2.3svn33164-lp150.5.6.1 texlive-limap-2017.137.2.1svn41390-lp150.5.6.1 texlive-limap-doc-2017.137.2.1svn41390-lp150.5.6.1 texlive-linearA-2017.137.svn15878-lp150.5.6.1 texlive-linearA-doc-2017.137.svn15878-lp150.5.6.1 texlive-linearA-fonts-2017.137.svn15878-lp150.5.6.1 texlive-linegoal-2017.137.2.9svn21523-lp150.5.6.1 texlive-linegoal-doc-2017.137.2.9svn21523-lp150.5.6.1 texlive-lineno-2017.137.4.41svn21442-lp150.5.6.1 texlive-lineno-doc-2017.137.4.41svn21442-lp150.5.6.1 texlive-ling-macros-2017.137.svn42268-lp150.5.6.1 texlive-ling-macros-doc-2017.137.svn42268-lp150.5.6.1 texlive-linguex-2017.137.4.3svn30815-lp150.5.6.1 texlive-linguex-doc-2017.137.4.3svn30815-lp150.5.6.1 texlive-linop-2017.137.0.0.1svn41304-lp150.5.6.1 texlive-linop-doc-2017.137.0.0.1svn41304-lp150.5.6.1 texlive-lion-msc-2017.137.0.0.27svn44131-lp150.5.6.1 texlive-lion-msc-doc-2017.137.0.0.27svn44131-lp150.5.6.1 texlive-lipsum-2017.137.1.3svn34800-lp150.5.6.1 texlive-lipsum-doc-2017.137.1.3svn34800-lp150.5.6.1 texlive-lisp-on-tex-2017.137.2.0svn38722-lp150.5.6.1 texlive-lisp-on-tex-doc-2017.137.2.0svn38722-lp150.5.6.1 texlive-listbib-2017.137.2.2svn29349-lp150.5.6.1 texlive-listbib-doc-2017.137.2.2svn29349-lp150.5.6.1 texlive-listing-2017.137.1.2svn17373-lp150.5.6.1 texlive-listing-doc-2017.137.1.2svn17373-lp150.5.6.1 texlive-listings-2017.137.1.6svn37534-lp150.5.6.1 texlive-listings-doc-2017.137.1.6svn37534-lp150.5.6.1 texlive-listings-ext-2017.137.67svn29349-lp150.5.6.1 texlive-listings-ext-doc-2017.137.67svn29349-lp150.5.6.1 texlive-listlbls-2017.137.1.03svn34893-lp150.5.6.1 texlive-listlbls-doc-2017.137.1.03svn34893-lp150.5.6.1 texlive-listliketab-2017.137.svn15878-lp150.5.6.1 texlive-listliketab-doc-2017.137.svn15878-lp150.5.6.1 texlive-listofitems-2017.137.1.3svn42530-lp150.5.6.1 texlive-listofitems-doc-2017.137.1.3svn42530-lp150.5.6.1 texlive-listofsymbols-2017.137.0.0.2svn16134-lp150.5.6.1 texlive-listofsymbols-doc-2017.137.0.0.2svn16134-lp150.5.6.1 texlive-lithuanian-2017.137.svn22722-lp150.5.6.1 texlive-lithuanian-doc-2017.137.svn22722-lp150.5.6.1 texlive-liturg-2017.137.1.0svn15878-lp150.5.6.1 texlive-liturg-doc-2017.137.1.0svn15878-lp150.5.6.1 texlive-lkproof-2017.137.3.1svn20021-lp150.5.6.1 texlive-lkproof-doc-2017.137.3.1svn20021-lp150.5.6.1 texlive-lm-2017.137.2.004svn28119-lp150.5.6.1 texlive-lm-doc-2017.137.2.004svn28119-lp150.5.6.1 texlive-lm-fonts-2017.137.2.004svn28119-lp150.5.6.1 texlive-lm-math-2017.137.1.959svn36915-lp150.5.6.1 texlive-lm-math-doc-2017.137.1.959svn36915-lp150.5.6.1 texlive-lm-math-fonts-2017.137.1.959svn36915-lp150.5.6.1 texlive-lmake-2017.137.1.0svn25552-lp150.5.6.1 texlive-lmake-doc-2017.137.1.0svn25552-lp150.5.6.1 texlive-lni-2017.137.1.3svn44368-lp150.5.6.1 texlive-lni-doc-2017.137.1.3svn44368-lp150.5.6.1 texlive-lobster2-2017.137.svn32617-lp150.5.6.1 texlive-lobster2-doc-2017.137.svn32617-lp150.5.6.1 texlive-lobster2-fonts-2017.137.svn32617-lp150.5.6.1 texlive-locality-2017.137.0.0.2svn20422-lp150.5.6.1 texlive-locality-doc-2017.137.0.0.2svn20422-lp150.5.6.1 texlive-localloc-2017.137.svn21934-lp150.5.6.1 texlive-localloc-doc-2017.137.svn21934-lp150.5.6.1 texlive-logbox-2017.137.1.0svn24499-lp150.5.6.1 texlive-logbox-doc-2017.137.1.0svn24499-lp150.5.6.1 texlive-logical-markup-utils-2017.137.svn15878-lp150.5.6.1 texlive-logical-markup-utils-doc-2017.137.svn15878-lp150.5.6.1 texlive-logicproof-2017.137.svn33254-lp150.5.6.1 texlive-logicproof-doc-2017.137.svn33254-lp150.5.6.1 texlive-logicpuzzle-2017.137.2.5svn34491-lp150.5.6.1 texlive-logicpuzzle-doc-2017.137.2.5svn34491-lp150.5.6.1 texlive-logpap-2017.137.0.0.6svn15878-lp150.5.6.1 texlive-logpap-doc-2017.137.0.0.6svn15878-lp150.5.6.1 texlive-logreq-2017.137.1.0svn19640-lp150.5.6.1 texlive-logreq-doc-2017.137.1.0svn19640-lp150.5.6.1 texlive-lollipop-2017.137.1.07svn41438-lp150.5.6.1 texlive-lollipop-doc-2017.137.1.07svn41438-lp150.5.6.1 texlive-longdivision-2017.137.1.0svn43159-lp150.5.6.1 texlive-longdivision-doc-2017.137.1.0svn43159-lp150.5.6.1 texlive-longfbox-2017.137.1.0svn39028-lp150.5.6.1 texlive-longfbox-doc-2017.137.1.0svn39028-lp150.5.6.1 texlive-longfigure-2017.137.1.0svn34302-lp150.5.6.1 texlive-longfigure-doc-2017.137.1.0svn34302-lp150.5.6.1 texlive-longnamefilelist-2017.137.0.0.2svn27889-lp150.5.6.1 texlive-longnamefilelist-doc-2017.137.0.0.2svn27889-lp150.5.6.1 texlive-loops-2017.137.1.3svn30704-lp150.5.6.1 texlive-loops-doc-2017.137.1.3svn30704-lp150.5.6.1 texlive-lpform-2017.137.svn36918-lp150.5.6.1 texlive-lpform-doc-2017.137.svn36918-lp150.5.6.1 texlive-lpic-2017.137.0.0.8svn20843-lp150.5.6.1 texlive-lpic-doc-2017.137.0.0.8svn20843-lp150.5.6.1 texlive-lplfitch-2017.137.0.0.9svn31077-lp150.5.6.1 texlive-lplfitch-doc-2017.137.0.0.9svn31077-lp150.5.6.1 texlive-lps-2017.137.0.0.7svn21322-lp150.5.6.1 texlive-lps-doc-2017.137.0.0.7svn21322-lp150.5.6.1 texlive-lroundrect-2017.137.1.0svn39804-lp150.5.6.1 texlive-lroundrect-doc-2017.137.1.0svn39804-lp150.5.6.1 texlive-lsc-2017.137.svn15878-lp150.5.6.1 texlive-lsc-doc-2017.137.svn15878-lp150.5.6.1 texlive-lshort-bulgarian-2017.137.svn15878-lp150.5.6.1 texlive-lshort-chinese-2017.137.5.10svn43606-lp150.5.6.1 texlive-lshort-czech-2017.137.4.27svn29803-lp150.5.6.1 texlive-lshort-dutch-2017.137.1.3svn15878-lp150.5.6.1 texlive-lshort-english-2017.137.5.0.5svn37892-lp150.5.6.1 texlive-lshort-estonian-2017.137.5.05svn39323-lp150.5.6.1 texlive-lshort-finnish-2017.137.svn15878-lp150.5.6.1 texlive-lshort-french-2017.137.5.01fr_0svn23332-lp150.5.6.1 texlive-lshort-german-2017.137.3.0bsvn42434-lp150.5.6.1 References: https://bugzilla.suse.com/1118796

1 0

openSUSE-SU-2019:0249-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 26 Feb '19

26 Feb '19

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0249-1 Rating: important References: #1122983 #1125330 Cross-References: CVE-2016-5824 CVE-2018-12405 CVE-2018-17466 CVE-2018-18335 CVE-2018-18356 CVE-2018-18492 CVE-2018-18493 CVE-2018-18494 CVE-2018-18498 CVE-2018-18500 CVE-2018-18501 CVE-2018-18505 CVE-2018-18509 CVE-2019-5785 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 60.5.1 fixes the following issues: Security vulnerabilities addressed (MFSA 2019-03 MFSA 2018-31 bsc#1122983 and MFSA 2019-06 bsc#1125330): - CVE-2018-18356: Fixed a Use-after-free in Skia. - CVE-2019-5785: Fixed an Integer overflow in Skia. - CVE-2018-18335: Fixed a Buffer overflow in Skia by default deactivating Canvas 2D. This issue does not affect Linuc distributions. - CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures showing mistekenly that emails bring a valid sugnature. - CVE-2018-18500: Use-after-free parsing HTML5 stream - CVE-2018-18505: Privilege escalation through IPC channel messages - CVE-2016-5824: DoS (use-after-free) via a crafted ics file - CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 - CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11 - CVE-2018-18492: Use-after-free with select element - CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia - CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs - CVE-2018-18498: Integer overflow when calculating buffer sizes for images - CVE-2018-12405: Memory safety bugs Other bug fixes and changes: * FileLink provider WeTransfer to upload large attachments * Thunderbird now allows the addition of OpenSearch search engines from a local XML file using a minimal user inferface: [+] button to select a file an add, [-] to remove. * More search engines: Google and DuckDuckGo available by default in some locales * During account creation, Thunderbird will now detect servers using the Microsoft Exchange protocol. It will offer the installation of a 3rd party add-on (Owl) which supports that protocol. * Thunderbird now compatible with other WebExtension-based FileLink add-ons like the Dropbox add-on * New WebExtensions FileLink API to facilitate add-ons * Fix decoding problems for messages with less common charsets (cp932, cp936) * New messages in the drafts folder (and other special or virtual folders) will no longer be included in the new messages notification * Thunderbird 60 will migrate security databases (key3.db, cert8.db to key4.db, cert9.db). Thunderbird 60.3.2 and earlier contained a fault that potentially deleted saved passwords and private certificate keys for users using a master password. Version 60.3.3 will prevent the loss of data; affected users who have already upgraded to version 60.3.2 or earlier can restore the deleted key3.db file from backup to complete the migration. * Address book search and auto-complete slowness introduced in Thunderbird 60.3.2 * Plain text markup with * for bold, / for italics, _ for underline and | for code did not work when the enclosed text contained non-ASCII characters * While composing a message, a link not removed when link location was removed in the link properties panel * Encoding problems when exporting address books or messages using the system charset. Messages are now always exported using the UTF-8 encoding * If the "Date" header of a message was invalid, Jan 1970 or Dec 1969 was displayed. Now using date from "Received" header instead. * Body search/filtering didn't reliably ignore content of tags * Inappropriate warning "Thunderbird prevented the site (addons.thunderbird.net) from asking you to install software on your computer" when installing add-ons * Incorrect display of correspondents column since own email address was not always detected * Spurious 
 (encoded newline) inserted into drafts and sent email * Double-clicking on a word in the Write window sometimes launched the Advanced Property Editor or Link Properties dialog * Fixe Cookie removal * "Download rest of message" was not working if global inbox was used * Fix Encoding problems for users (especially in Poland) when a file was sent via a folder using "Sent to > Mail recipient" due to a problem in the Thunderbird MAPI interface * According to RFC 4616 and RFC 5721, passwords containing non-ASCII characters are encoded using UTF-8 which can lead to problems with non-compliant providers, for example office365.com. The SMTP LOGIN and POP3 USER/PASS authentication methods are now using a Latin-1 encoding again to work around this issue * Fix shutdown crash/hang after entering an empty IMAP password Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-249=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-60.5.1-79.1 MozillaThunderbird-buildsymbols-60.5.1-79.1 MozillaThunderbird-translations-common-60.5.1-79.1 MozillaThunderbird-translations-other-60.5.1-79.1 References: https://www.suse.com/security/cve/CVE-2016-5824.html https://www.suse.com/security/cve/CVE-2018-12405.html https://www.suse.com/security/cve/CVE-2018-17466.html https://www.suse.com/security/cve/CVE-2018-18335.html https://www.suse.com/security/cve/CVE-2018-18356.html https://www.suse.com/security/cve/CVE-2018-18492.html https://www.suse.com/security/cve/CVE-2018-18493.html https://www.suse.com/security/cve/CVE-2018-18494.html https://www.suse.com/security/cve/CVE-2018-18498.html https://www.suse.com/security/cve/CVE-2018-18500.html https://www.suse.com/security/cve/CVE-2018-18501.html https://www.suse.com/security/cve/CVE-2018-18505.html https://www.suse.com/security/cve/CVE-2018-18509.html https://www.suse.com/security/cve/CVE-2019-5785.html https://bugzilla.suse.com/1122983 https://bugzilla.suse.com/1125330

1 0

openSUSE-SU-2019:0248-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 26 Feb '19

26 Feb '19

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0248-1 Rating: important References: #1125330 Cross-References: CVE-2018-18356 CVE-2019-5785 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for MozillaFirefox to version 60.5.1esr fixes the following issues: Security vulnerabilities addressed (MFSA-2019-05, boo#1125330): - CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library that could occur when creating a path, leading to a potentially exploitable crash. - CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library that could occur after specific transform operations, leading to a potentially exploitable crash. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-248=1 Package List: - openSUSE Leap 15.0 (x86_64): MozillaFirefox-60.5.1-lp150.3.39.2 MozillaFirefox-branding-upstream-60.5.1-lp150.3.39.2 MozillaFirefox-buildsymbols-60.5.1-lp150.3.39.2 MozillaFirefox-debuginfo-60.5.1-lp150.3.39.2 MozillaFirefox-debugsource-60.5.1-lp150.3.39.2 MozillaFirefox-devel-60.5.1-lp150.3.39.2 MozillaFirefox-translations-common-60.5.1-lp150.3.39.2 MozillaFirefox-translations-other-60.5.1-lp150.3.39.2 References: https://www.suse.com/security/cve/CVE-2018-18356.html https://www.suse.com/security/cve/CVE-2019-5785.html https://bugzilla.suse.com/1125330

1 0