March 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2019:0334-1: moderate: Recommended update for libtirpc
by maintenance＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Recommended Update: Recommended update for libtirpc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0334-1 Rating: moderate References: #1120689 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libtirpc fixes the following issues: - Adds a new option to enforce connection via protocol version 2 first (bsc#1120689) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-334=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libtirpc-debugsource-1.0.1-5.6.1 libtirpc-devel-1.0.1-5.6.1 libtirpc-netconfig-1.0.1-5.6.1 libtirpc3-1.0.1-5.6.1 libtirpc3-debuginfo-1.0.1-5.6.1 - openSUSE Leap 42.3 (x86_64): libtirpc3-32bit-1.0.1-5.6.1 libtirpc3-debuginfo-32bit-1.0.1-5.6.1 References: https://bugzilla.suse.com/1120689

1 0

openSUSE-RU-2019:0335-1: moderate: Recommended update for cups
by maintenance＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Recommended Update: Recommended update for cups ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0335-1 Rating: moderate References: #1118118 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for cups fixes the following issues: - Fixed a cups crash when using utf8 filenames (bsc#1118118) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-335=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): cups-1.7.5-12.12.1 cups-client-1.7.5-12.12.1 cups-client-debuginfo-1.7.5-12.12.1 cups-ddk-1.7.5-12.12.1 cups-ddk-debuginfo-1.7.5-12.12.1 cups-debuginfo-1.7.5-12.12.1 cups-debugsource-1.7.5-12.12.1 cups-devel-1.7.5-12.12.1 cups-libs-1.7.5-12.12.1 cups-libs-debuginfo-1.7.5-12.12.1 - openSUSE Leap 42.3 (x86_64): cups-libs-32bit-1.7.5-12.12.1 cups-libs-debuginfo-32bit-1.7.5-12.12.1 References: https://bugzilla.suse.com/1118118

1 0

openSUSE-SU-2019:0329-1: important: Security update for obs-service-tar_scm
by opensuse-security＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Security Update: Security update for obs-service-tar_scm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0329-1 Rating: important References: #1076410 #1082696 #1105361 #1107507 #1107944 Cross-References: CVE-2018-12473 CVE-2018-12474 CVE-2018-12476 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for obs-service-tar_scm fixes the following issues: Security vulnerabilities addressed: - CVE-2018-12473: Fixed a path traversal issue, which allowed users to access files outside of the repository using relative paths (bsc#1105361) - CVE-2018-12474: Fixed an issue whereby crafted service parameters allowed for unexpected behaviour (bsc#1107507) - CVE-2018-12476: Fixed an issue whereby the outfilename parameter allowed to write files outside of package directory (bsc#1107944) Other bug fixes and changes made: - Prefer UTF-8 locale as output format for changes - added KankuFile - fix problems with unicode source files - added python-six to Requires in specfile - better encoding handling - fixes bsc#1082696 and bsc#1076410 - fix unicode in containers - move to python3 - added logging for better debugging changesgenerate - raise exception if no changesauthor given - Stop using @opensuse.org addresses to indicate a missing address - move argparse dep to -common package - allow submodule and ssl options in appimage - sync spec file as used in openSUSE:Tools project - check encoding problems for svn and print proper error msg - added new param '--locale' - separate service file installation in GNUmakefile - added glibc as Recommends in spec file - cleanup for broken svn caches - another fix for unicode problem in obs_scm - Final fix for unicode in filenames - Another attempt to fix unicode filenames in prep_tree_for_archive - Another attempt to fix unicode filenames in prep_tree_for_archive - fix bug with unicode filenames in prep_tree_for_archive - reuse _service*_servicedata/changes files from previous service runs - fix problems with unicode characters in commit messages for changeloggenerate - fix encoding issues if commit message contains utf8 char - revert encoding for old changes file - remove hardcoded utf-8 encodings - Add support for extract globbing - split pylint2 in GNUmakefile - fix check for "--reproducible" - create reproducible obscpio archives - fix regression from 44b3bee - Support also SSH urls for Git - check name/version option in obsinfo for slashes - check url for remote url - check symlinks in subdir parameter - check filename for slashes - disable follow_symlinks in extract feature - switch to obs_scm for this package - run download_files in appimage and snapcraft case - check --extract file path for parent dir - Fix parameter descriptions - changed os.removedirs -> shutil.rmtree - Adding information regarding the *package-metadata* option for the *tar* service The tar service is highly useful in combination with the *obscpio* service. After the fix for the metadata for the latter one, it is important to inform the users of the *tar* service that metadata is kept only if the flag *package-metadata* is enabled. Add the flag to the .service file for mentioning that. - Allow metadata packing for CPIO archives when desired As of now, metadata are always excluded from *obscpio* packages. This is because the *package-metadata* flag is ignored; this change (should) make *obscpio* aware of it. - improve handling of corrupt git cache directories - only do git stash save/pop if we have a non-empty working tree (#228) - don't allow DEBUG_TAR_SCM to change behaviour (#240) - add stub user docs in lieu of something proper (#238) - Remove clone_dir if clone fails - python-unittest2 is only required for the optional make check - move python-unittest2 dep to test suite only part (submission by olh) - Removing redundant pass statement - missing import for logging functions. - [backend] Adding http proxy support - python-unittest2 is only required for the optional make check - make installation of scm's optional - add a lot more detail to README - Git clone with --no-checkout in prepare_working_copy - Refactor and simplify git prepare_working_copy - Only use current dir if it actually looks like git (Fixes #202) - reactivate test_obscpio_extract_d - fix broken test create_archive - fix broken tests for broken-links - changed PREFIX in Gnumakefile to /usr - new cli option --skip-cleanup - fix for broken links - fix reference to snapcraft YAML file - fix docstring typo in TarSCM.scm.tar.fetch_upstream - acknowledge deficiencies in dev docs - wrap long lines in README This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-329=1 Package List: - openSUSE Backports SLE-15 (noarch): obs-service-appimage-0.10.5.1551309990.79898c7-bp150.3.3.1 obs-service-obs_scm-0.10.5.1551309990.79898c7-bp150.3.3.1 obs-service-obs_scm-common-0.10.5.1551309990.79898c7-bp150.3.3.1 obs-service-snapcraft-0.10.5.1551309990.79898c7-bp150.3.3.1 obs-service-tar-0.10.5.1551309990.79898c7-bp150.3.3.1 obs-service-tar_scm-0.10.5.1551309990.79898c7-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-12473.html https://www.suse.com/security/cve/CVE-2018-12474.html https://www.suse.com/security/cve/CVE-2018-12476.html https://bugzilla.suse.com/1076410 https://bugzilla.suse.com/1082696 https://bugzilla.suse.com/1105361 https://bugzilla.suse.com/1107507 https://bugzilla.suse.com/1107944

1 0

openSUSE-SU-2019:0328-1: moderate: Security update for libcomps
by opensuse-security＠opensuse.org 15 Mar '19

15 Mar '19

openSUSE Security Update: Security update for libcomps ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0328-1 Rating: moderate References: #1122841 Cross-References: CVE-2019-3817 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libcomps fixes the following issue: Security issue fixed: - CVE-2019-3817: Fixed a use-after-free vulnerability in comps_objmradix.c:comps_objmrtree_unite() function where could allow to application crash or code execution (bsc#1122841). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-328=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): libcomps-devel-0.1.8-bp150.3.3.1 libcomps0_1_6-0.1.8-bp150.3.3.1 python2-libcomps-0.1.8-bp150.3.3.1 python3-libcomps-0.1.8-bp150.3.3.1 - openSUSE Backports SLE-15 (noarch): libcomps-doc-0.1.8-bp150.3.3.1 python-libcomps-doc-0.1.8-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-3817.html https://bugzilla.suse.com/1122841

1 0

openSUSE-SU-2019:0325-1: important: Security update for freerdp
by opensuse-security＠opensuse.org 13 Mar '19

13 Mar '19

openSUSE Security Update: Security update for freerdp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0325-1 Rating: important References: #1085416 #1087240 #1103557 #1104918 #1112028 #1116708 #1117963 #1117964 #1117965 #1117966 #1117967 #1120507 Cross-References: CVE-2018-0886 CVE-2018-1000852 CVE-2018-8784 CVE-2018-8785 CVE-2018-8786 CVE-2018-8787 CVE-2018-8788 CVE-2018-8789 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has four fixes is now available. Description: This update for freerdp to version 2.0.0~rc4 fixes the following issues: Security issues fixed: - CVE-2018-0886: Fix a remote code execution vulnerability (CredSSP) (bsc#1085416, bsc#1087240, bsc#1104918) - CVE-2018-8789: Fix several denial of service vulnerabilities in the in the NTLM Authentication module (bsc#1117965) - CVE-2018-8785: Fix a potential remote code execution vulnerability in the zgfx_decompress function (bsc#1117967) - CVE-2018-8786: Fix a potential remote code execution vulnerability in the update_read_bitmap_update function (bsc#1117966) - CVE-2018-8787: Fix a potential remote code execution vulnerability in the gdi_Bitmap_Decompress function (bsc#1117964) - CVE-2018-8788: Fix a potential remote code execution vulnerability in the nsc_rle_decode function (bsc#1117963) - CVE-2018-8784: Fix a potential remote code execution vulnerability in the zgfx_decompress_segment function (bsc#1116708) - CVE-2018-1000852: Fixed a remote memory access in the drdynvc_process_capability_request function (bsc#1120507) Other issues: - Upgraded to version 2.0.0-rc4 (FATE#326739) - Security and stability improvements, including bsc#1103557 and bsc#1112028 - gateway: multiple fixes and improvements - client/X11: support for rail (remote app) icons was added - The licensing code was re-worked: Per-device licenses are now saved on the client and used on re-connect: WARNING: this is a change in FreeRDP behavior regarding licensing. If the old behavior is required, or no licenses should be saved use the new command line option +old-license (gh#/FreeRDP/FreeRDP#4979) - Improved order handling - only orders that were enable during capability exchange are accepted. WARNING and NOTE: some servers do improperly send orders that weren't negotiated, for such cases the new command line option /relax-order-checks was added to disable the strict order checking. If connecting to xrdp the options /relax-order-checks *and* +glyph-cache are required. (gh#/FreeRDP/FreeRDP#4926) - Fixed automount issues - Fixed several audio and microphone related issues - Fixed X11 Right-Ctrl ungrab feature - Fixed race condition in rdpsnd channel server. - Disabled SSE2 for ARM and powerpc This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-325=1 Package List: - openSUSE Leap 15.0 (x86_64): freerdp-2.0.0~rc4-lp150.2.3.1 freerdp-debuginfo-2.0.0~rc4-lp150.2.3.1 freerdp-debugsource-2.0.0~rc4-lp150.2.3.1 freerdp-devel-2.0.0~rc4-lp150.2.3.1 freerdp-server-2.0.0~rc4-lp150.2.3.1 freerdp-server-debuginfo-2.0.0~rc4-lp150.2.3.1 freerdp-wayland-2.0.0~rc4-lp150.2.3.1 freerdp-wayland-debuginfo-2.0.0~rc4-lp150.2.3.1 libfreerdp2-2.0.0~rc4-lp150.2.3.1 libfreerdp2-debuginfo-2.0.0~rc4-lp150.2.3.1 libuwac0-0-2.0.0~rc4-lp150.2.3.1 libuwac0-0-debuginfo-2.0.0~rc4-lp150.2.3.1 libwinpr2-2.0.0~rc4-lp150.2.3.1 libwinpr2-debuginfo-2.0.0~rc4-lp150.2.3.1 uwac0-0-devel-2.0.0~rc4-lp150.2.3.1 winpr2-devel-2.0.0~rc4-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-0886.html https://www.suse.com/security/cve/CVE-2018-1000852.html https://www.suse.com/security/cve/CVE-2018-8784.html https://www.suse.com/security/cve/CVE-2018-8785.html https://www.suse.com/security/cve/CVE-2018-8786.html https://www.suse.com/security/cve/CVE-2018-8787.html https://www.suse.com/security/cve/CVE-2018-8788.html https://www.suse.com/security/cve/CVE-2018-8789.html https://bugzilla.suse.com/1085416 https://bugzilla.suse.com/1087240 https://bugzilla.suse.com/1103557 https://bugzilla.suse.com/1104918 https://bugzilla.suse.com/1112028 https://bugzilla.suse.com/1116708 https://bugzilla.suse.com/1117963 https://bugzilla.suse.com/1117964 https://bugzilla.suse.com/1117965 https://bugzilla.suse.com/1117966 https://bugzilla.suse.com/1117967 https://bugzilla.suse.com/1120507

1 0

openSUSE-SU-2019:0327-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 13 Mar '19

13 Mar '19

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0327-1 Rating: important References: #1013882 #1101676 #1101677 #1101678 #1103342 #1111858 #1111859 #1112368 #1112377 #1112384 #1112386 #1112391 #1112397 #1112404 #1112415 #1112417 #1112421 #1112432 #1112767 #1116686 #1118754 #1120041 #1122198 #1122475 #1127027 Cross-References: CVE-2016-9843 CVE-2018-3058 CVE-2018-3060 CVE-2018-3063 CVE-2018-3064 CVE-2018-3066 CVE-2018-3143 CVE-2018-3156 CVE-2018-3162 CVE-2018-3173 CVE-2018-3174 CVE-2018-3185 CVE-2018-3200 CVE-2018-3251 CVE-2018-3277 CVE-2018-3282 CVE-2018-3284 CVE-2019-2510 CVE-2019-2537 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves 19 vulnerabilities and has 6 fixes is now available. Description: This update for mariadb to version 10.2.22 fixes the following issues: Security issues fixed: - CVE-2019-2510: Fixed a vulnerability which can lead to MySQL compromise and lead to Denial of Service (bsc#1122198). - CVE-2019-2537: Fixed a vulnerability which can lead to MySQL compromise and lead to Denial of Service (bsc#1122198). - CVE-2018-3284: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112377) - CVE-2018-3282: Server Storage Engines unspecified vulnerability (CPU Oct 2018) (bsc#1112432) - CVE-2018-3277: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112391) - CVE-2018-3251: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112397) - CVE-2018-3200: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112404) - CVE-2018-3185: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112384) - CVE-2018-3174: Client programs unspecified vulnerability (CPU Oct 2018) (bsc#1112368) - CVE-2018-3173: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112386) - CVE-2018-3162: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112415) - CVE-2018-3156: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112417) - CVE-2018-3143: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112421) - CVE-2018-3066: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent Server Options). (bsc#1101678) - CVE-2018-3064: InnoDB unspecified vulnerability (CPU Jul 2018) (bsc#1103342) - CVE-2018-3063: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent Server Security Privileges). (bsc#1101677) - CVE-2018-3058: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent MyISAM). (bsc#1101676) - CVE-2016-9843: Big-endian out-of-bounds pointer (bsc#1013882) Non-security issues fixed: - Fixed an issue where mysl_install_db fails due to incorrect basedir (bsc#1127027). - Fixed an issue where the lograte was not working (bsc#1112767). - Backport Information Schema CHECK_CONSTRAINTS Table. - Maximum value of table_definition_cache is now 2097152. - InnoDB ALTER TABLE fixes. - Galera crash recovery fixes. - Encryption fixes. - Remove xtrabackup dependency as MariaDB ships a build in mariabackup so xtrabackup is not needed (bsc#1122475). - Maria DB testsuite - test main.plugin_auth failed (bsc#1111859) - Maria DB testsuite - test encryption.second_plugin-12863 failed (bsc#1111858) - Remove PerconaFT from the package as it has AGPL licence (bsc#1118754) - remove PerconaFT from the package as it has AGPL licence (bsc#1118754) - Database corruption after renaming a prefix-indexed column (bsc#1120041) Release notes and changelog: - https://mariadb.com/kb/en/library/mariadb-10222-release-notes - https://mariadb.com/kb/en/library/mariadb-10222-changelog/ This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-327=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libmysqld-devel-10.2.22-lp150.2.9.1 libmysqld19-10.2.22-lp150.2.9.1 libmysqld19-debuginfo-10.2.22-lp150.2.9.1 mariadb-10.2.22-lp150.2.9.1 mariadb-bench-10.2.22-lp150.2.9.1 mariadb-bench-debuginfo-10.2.22-lp150.2.9.1 mariadb-client-10.2.22-lp150.2.9.1 mariadb-client-debuginfo-10.2.22-lp150.2.9.1 mariadb-debuginfo-10.2.22-lp150.2.9.1 mariadb-debugsource-10.2.22-lp150.2.9.1 mariadb-galera-10.2.22-lp150.2.9.1 mariadb-test-10.2.22-lp150.2.9.1 mariadb-test-debuginfo-10.2.22-lp150.2.9.1 mariadb-tools-10.2.22-lp150.2.9.1 mariadb-tools-debuginfo-10.2.22-lp150.2.9.1 - openSUSE Leap 15.0 (noarch): mariadb-errormessages-10.2.22-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2016-9843.html https://www.suse.com/security/cve/CVE-2018-3058.html https://www.suse.com/security/cve/CVE-2018-3060.html https://www.suse.com/security/cve/CVE-2018-3063.html https://www.suse.com/security/cve/CVE-2018-3064.html https://www.suse.com/security/cve/CVE-2018-3066.html https://www.suse.com/security/cve/CVE-2018-3143.html https://www.suse.com/security/cve/CVE-2018-3156.html https://www.suse.com/security/cve/CVE-2018-3162.html https://www.suse.com/security/cve/CVE-2018-3173.html https://www.suse.com/security/cve/CVE-2018-3174.html https://www.suse.com/security/cve/CVE-2018-3185.html https://www.suse.com/security/cve/CVE-2018-3200.html https://www.suse.com/security/cve/CVE-2018-3251.html https://www.suse.com/security/cve/CVE-2018-3277.html https://www.suse.com/security/cve/CVE-2018-3282.html https://www.suse.com/security/cve/CVE-2018-3284.html https://www.suse.com/security/cve/CVE-2019-2510.html https://www.suse.com/security/cve/CVE-2019-2537.html https://bugzilla.suse.com/1013882 https://bugzilla.suse.com/1101676 https://bugzilla.suse.com/1101677 https://bugzilla.suse.com/1101678 https://bugzilla.suse.com/1103342 https://bugzilla.suse.com/1111858 https://bugzilla.suse.com/1111859 https://bugzilla.suse.com/1112368 https://bugzilla.suse.com/1112377 https://bugzilla.suse.com/1112384 https://bugzilla.suse.com/1112386 https://bugzilla.suse.com/1112391 https://bugzilla.suse.com/1112397 https://bugzilla.suse.com/1112404 https://bugzilla.suse.com/1112415 https://bugzilla.suse.com/1112417 https://bugzilla.suse.com/1112421 https://bugzilla.suse.com/1112432 https://bugzilla.suse.com/1112767 https://bugzilla.suse.com/1116686 https://bugzilla.suse.com/1118754 https://bugzilla.suse.com/1120041 https://bugzilla.suse.com/1122198 https://bugzilla.suse.com/1122475 https://bugzilla.suse.com/1127027

1 0

openSUSE-SU-2019:0326-1: important: Security update for obs-service-tar_scm
by opensuse-security＠opensuse.org 13 Mar '19

13 Mar '19

openSUSE Security Update: Security update for obs-service-tar_scm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0326-1 Rating: important References: #1076410 #1082696 #1105361 #1107507 #1107944 Cross-References: CVE-2018-12473 CVE-2018-12474 CVE-2018-12476 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for obs-service-tar_scm fixes the following issues: Security vulnerabilities addressed: - CVE-2018-12473: Fixed a path traversal issue, which allowed users to access files outside of the repository using relative paths (bsc#1105361) - CVE-2018-12474: Fixed an issue whereby crafted service parameters allowed for unexpected behaviour (bsc#1107507) - CVE-2018-12476: Fixed an issue whereby the outfilename parameter allowed to write files outside of package directory (bsc#1107944) Other bug fixes and changes made: - Prefer UTF-8 locale as output format for changes - added KankuFile - fix problems with unicode source files - added python-six to Requires in specfile - better encoding handling - fixes bsc#1082696 and bsc#1076410 - fix unicode in containers - move to python3 - added logging for better debugging changesgenerate - raise exception if no changesauthor given - Stop using @opensuse.org addresses to indicate a missing address - move argparse dep to -common package - allow submodule and ssl options in appimage - sync spec file as used in openSUSE:Tools project - check encoding problems for svn and print proper error msg - added new param '--locale' - separate service file installation in GNUmakefile - added glibc as Recommends in spec file - cleanup for broken svn caches - another fix for unicode problem in obs_scm - Final fix for unicode in filenames - Another attempt to fix unicode filenames in prep_tree_for_archive - Another attempt to fix unicode filenames in prep_tree_for_archive - fix bug with unicode filenames in prep_tree_for_archive - reuse _service*_servicedata/changes files from previous service runs - fix problems with unicode characters in commit messages for changeloggenerate - fix encoding issues if commit message contains utf8 char - revert encoding for old changes file - remove hardcoded utf-8 encodings - Add support for extract globbing - split pylint2 in GNUmakefile - fix check for "--reproducible" - create reproducible obscpio archives - fix regression from 44b3bee - Support also SSH urls for Git - check name/version option in obsinfo for slashes - check url for remote url - check symlinks in subdir parameter - check filename for slashes - disable follow_symlinks in extract feature - switch to obs_scm for this package - run download_files in appimage and snapcraft case - check --extract file path for parent dir - Fix parameter descriptions - changed os.removedirs -> shutil.rmtree - Adding information regarding the *package-metadata* option for the *tar* service The tar service is highly useful in combination with the *obscpio* service. After the fix for the metadata for the latter one, it is important to inform the users of the *tar* service that metadata is kept only if the flag *package-metadata* is enabled. Add the flag to the .service file for mentioning that. - Allow metadata packing for CPIO archives when desired As of now, metadata are always excluded from *obscpio* packages. This is because the *package-metadata* flag is ignored; this change (should) make *obscpio* aware of it. - improve handling of corrupt git cache directories - only do git stash save/pop if we have a non-empty working tree (#228) - don't allow DEBUG_TAR_SCM to change behaviour (#240) - add stub user docs in lieu of something proper (#238) - Remove clone_dir if clone fails - python-unittest2 is only required for the optional make check - move python-unittest2 dep to test suite only part (submission by olh) - Removing redundant pass statement - missing import for logging functions. - [backend] Adding http proxy support - python-unittest2 is only required for the optional make check - make installation of scm's optional - add a lot more detail to README - Git clone with --no-checkout in prepare_working_copy - Refactor and simplify git prepare_working_copy - Only use current dir if it actually looks like git (Fixes #202) - reactivate test_obscpio_extract_d - fix broken test create_archive - fix broken tests for broken-links - changed PREFIX in Gnumakefile to /usr - new cli option --skip-cleanup - fix for broken links - fix reference to snapcraft YAML file - fix docstring typo in TarSCM.scm.tar.fetch_upstream - acknowledge deficiencies in dev docs - wrap long lines in README This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-326=1 Package List: - openSUSE Leap 15.0 (noarch): obs-service-appimage-0.10.5.1551309990.79898c7-lp150.2.3.1 obs-service-obs_scm-0.10.5.1551309990.79898c7-lp150.2.3.1 obs-service-obs_scm-common-0.10.5.1551309990.79898c7-lp150.2.3.1 obs-service-snapcraft-0.10.5.1551309990.79898c7-lp150.2.3.1 obs-service-tar-0.10.5.1551309990.79898c7-lp150.2.3.1 obs-service-tar_scm-0.10.5.1551309990.79898c7-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-12473.html https://www.suse.com/security/cve/CVE-2018-12474.html https://www.suse.com/security/cve/CVE-2018-12476.html https://bugzilla.suse.com/1076410 https://bugzilla.suse.com/1082696 https://bugzilla.suse.com/1105361 https://bugzilla.suse.com/1107507 https://bugzilla.suse.com/1107944

1 0

openSUSE-RU-2019:0324-1: moderate: Recommended update for libreoffice
by maintenance＠opensuse.org 13 Mar '19

13 Mar '19

openSUSE Recommended Update: Recommended update for libreoffice ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0324-1 Rating: moderate References: #1079744 #1088266 #1095755 #1107012 #1110345 #1110348 #1112112 #1112113 #1112114 #1117195 #1117300 #1124658 #882383 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 13 recommended fixes can now be installed. Description: This update for libreoffice fixes the following issues: LibreOffice was updated to the 6.1.5.2 release, containing lots of bugfixes. Various improvements to PPTX were also done: - SmartArt: Basic rendering of the Organizational Chart (bsc#1112114) - SmartArt: Basic rendering of Accent Process and Continuous Block Process (bsc#1112113) - Chart in PPTX lacks color and is too large (bsc#882383) - SmartArt: Basic rendering of several list types (bsc#1112112) - Charts having weird/darker/ugly background versus Office 365 and strange artefacts where overlapping (bsc#1110348) - Text on arc feature, export to PPTX (bsc#1088266) - PPTX Labels in chart change (from white and other colors) to black when saving as PPTX (bsc#1095755) - Chart showing numbers with post-comma digits versus rounded with Office 365 (bsc#1110345) - Font sizes and text position way off (too small,...) (bsc#1107012) Additional fixes: - [DATA LOSS] Saving a new document can silently (bsc#1117300) - Install also C++ libreofficekit headers (bsc#1117195) - unoil.jar does not contain any content in LibreOffice 5.4.4.2 update (bsc#1079744) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-324=1 Package List: - openSUSE Leap 42.3 (noarch): libreoffice-branding-upstream-6.1.5.2-30.3 libreoffice-gdb-pretty-printers-6.1.5.2-30.3 libreoffice-glade-6.1.5.2-30.3 libreoffice-icon-themes-6.1.5.2-30.3 libreoffice-l10n-af-6.1.5.2-30.3 libreoffice-l10n-am-6.1.5.2-30.3 libreoffice-l10n-ar-6.1.5.2-30.3 libreoffice-l10n-as-6.1.5.2-30.3 libreoffice-l10n-ast-6.1.5.2-30.3 libreoffice-l10n-be-6.1.5.2-30.3 libreoffice-l10n-bg-6.1.5.2-30.3 libreoffice-l10n-bn-6.1.5.2-30.3 libreoffice-l10n-bn_IN-6.1.5.2-30.3 libreoffice-l10n-bo-6.1.5.2-30.3 libreoffice-l10n-br-6.1.5.2-30.3 libreoffice-l10n-brx-6.1.5.2-30.3 libreoffice-l10n-bs-6.1.5.2-30.3 libreoffice-l10n-ca-6.1.5.2-30.3 libreoffice-l10n-ca_valencia-6.1.5.2-30.3 libreoffice-l10n-cs-6.1.5.2-30.3 libreoffice-l10n-cy-6.1.5.2-30.3 libreoffice-l10n-da-6.1.5.2-30.3 libreoffice-l10n-de-6.1.5.2-30.3 libreoffice-l10n-dgo-6.1.5.2-30.3 libreoffice-l10n-dz-6.1.5.2-30.3 libreoffice-l10n-el-6.1.5.2-30.3 libreoffice-l10n-en-6.1.5.2-30.3 libreoffice-l10n-en_GB-6.1.5.2-30.3 libreoffice-l10n-en_ZA-6.1.5.2-30.3 libreoffice-l10n-eo-6.1.5.2-30.3 libreoffice-l10n-es-6.1.5.2-30.3 libreoffice-l10n-et-6.1.5.2-30.3 libreoffice-l10n-eu-6.1.5.2-30.3 libreoffice-l10n-fa-6.1.5.2-30.3 libreoffice-l10n-fi-6.1.5.2-30.3 libreoffice-l10n-fr-6.1.5.2-30.3 libreoffice-l10n-fy-6.1.5.2-30.3 libreoffice-l10n-ga-6.1.5.2-30.3 libreoffice-l10n-gd-6.1.5.2-30.3 libreoffice-l10n-gl-6.1.5.2-30.3 libreoffice-l10n-gu-6.1.5.2-30.3 libreoffice-l10n-gug-6.1.5.2-30.3 libreoffice-l10n-he-6.1.5.2-30.3 libreoffice-l10n-hi-6.1.5.2-30.3 libreoffice-l10n-hr-6.1.5.2-30.3 libreoffice-l10n-hsb-6.1.5.2-30.3 libreoffice-l10n-hu-6.1.5.2-30.3 libreoffice-l10n-id-6.1.5.2-30.3 libreoffice-l10n-is-6.1.5.2-30.3 libreoffice-l10n-it-6.1.5.2-30.3 libreoffice-l10n-ja-6.1.5.2-30.3 libreoffice-l10n-ka-6.1.5.2-30.3 libreoffice-l10n-kab-6.1.5.2-30.3 libreoffice-l10n-kk-6.1.5.2-30.3 libreoffice-l10n-km-6.1.5.2-30.3 libreoffice-l10n-kmr_Latn-6.1.5.2-30.3 libreoffice-l10n-kn-6.1.5.2-30.3 libreoffice-l10n-ko-6.1.5.2-30.3 libreoffice-l10n-kok-6.1.5.2-30.3 libreoffice-l10n-ks-6.1.5.2-30.3 libreoffice-l10n-lb-6.1.5.2-30.3 libreoffice-l10n-lo-6.1.5.2-30.3 libreoffice-l10n-lt-6.1.5.2-30.3 libreoffice-l10n-lv-6.1.5.2-30.3 libreoffice-l10n-mai-6.1.5.2-30.3 libreoffice-l10n-mk-6.1.5.2-30.3 libreoffice-l10n-ml-6.1.5.2-30.3 libreoffice-l10n-mn-6.1.5.2-30.3 libreoffice-l10n-mni-6.1.5.2-30.3 libreoffice-l10n-mr-6.1.5.2-30.3 libreoffice-l10n-my-6.1.5.2-30.3 libreoffice-l10n-nb-6.1.5.2-30.3 libreoffice-l10n-ne-6.1.5.2-30.3 libreoffice-l10n-nl-6.1.5.2-30.3 libreoffice-l10n-nn-6.1.5.2-30.3 libreoffice-l10n-nr-6.1.5.2-30.3 libreoffice-l10n-nso-6.1.5.2-30.3 libreoffice-l10n-oc-6.1.5.2-30.3 libreoffice-l10n-om-6.1.5.2-30.3 libreoffice-l10n-or-6.1.5.2-30.3 libreoffice-l10n-pa-6.1.5.2-30.3 libreoffice-l10n-pl-6.1.5.2-30.3 libreoffice-l10n-pt_BR-6.1.5.2-30.3 libreoffice-l10n-pt_PT-6.1.5.2-30.3 libreoffice-l10n-ro-6.1.5.2-30.3 libreoffice-l10n-ru-6.1.5.2-30.3 libreoffice-l10n-rw-6.1.5.2-30.3 libreoffice-l10n-sa_IN-6.1.5.2-30.3 libreoffice-l10n-sat-6.1.5.2-30.3 libreoffice-l10n-sd-6.1.5.2-30.3 libreoffice-l10n-si-6.1.5.2-30.3 libreoffice-l10n-sid-6.1.5.2-30.3 libreoffice-l10n-sk-6.1.5.2-30.3 libreoffice-l10n-sl-6.1.5.2-30.3 libreoffice-l10n-sq-6.1.5.2-30.3 libreoffice-l10n-sr-6.1.5.2-30.3 libreoffice-l10n-ss-6.1.5.2-30.3 libreoffice-l10n-st-6.1.5.2-30.3 libreoffice-l10n-sv-6.1.5.2-30.3 libreoffice-l10n-sw_TZ-6.1.5.2-30.3 libreoffice-l10n-ta-6.1.5.2-30.3 libreoffice-l10n-te-6.1.5.2-30.3 libreoffice-l10n-tg-6.1.5.2-30.3 libreoffice-l10n-th-6.1.5.2-30.3 libreoffice-l10n-tn-6.1.5.2-30.3 libreoffice-l10n-tr-6.1.5.2-30.3 libreoffice-l10n-ts-6.1.5.2-30.3 libreoffice-l10n-tt-6.1.5.2-30.3 libreoffice-l10n-ug-6.1.5.2-30.3 libreoffice-l10n-uk-6.1.5.2-30.3 libreoffice-l10n-uz-6.1.5.2-30.3 libreoffice-l10n-ve-6.1.5.2-30.3 libreoffice-l10n-vec-6.1.5.2-30.3 libreoffice-l10n-vi-6.1.5.2-30.3 libreoffice-l10n-xh-6.1.5.2-30.3 libreoffice-l10n-zh_CN-6.1.5.2-30.3 libreoffice-l10n-zh_TW-6.1.5.2-30.3 libreoffice-l10n-zu-6.1.5.2-30.3 - openSUSE Leap 42.3 (x86_64): libreoffice-6.1.5.2-30.3 libreoffice-base-6.1.5.2-30.3 libreoffice-base-debuginfo-6.1.5.2-30.3 libreoffice-base-drivers-postgresql-6.1.5.2-30.3 libreoffice-base-drivers-postgresql-debuginfo-6.1.5.2-30.3 libreoffice-calc-6.1.5.2-30.3 libreoffice-calc-debuginfo-6.1.5.2-30.3 libreoffice-calc-extensions-6.1.5.2-30.3 libreoffice-debuginfo-6.1.5.2-30.3 libreoffice-debugsource-6.1.5.2-30.3 libreoffice-draw-6.1.5.2-30.3 libreoffice-draw-debuginfo-6.1.5.2-30.3 libreoffice-filters-optional-6.1.5.2-30.3 libreoffice-gnome-6.1.5.2-30.3 libreoffice-gnome-debuginfo-6.1.5.2-30.3 libreoffice-gtk2-6.1.5.2-30.3 libreoffice-gtk2-debuginfo-6.1.5.2-30.3 libreoffice-gtk3-6.1.5.2-30.3 libreoffice-gtk3-debuginfo-6.1.5.2-30.3 libreoffice-impress-6.1.5.2-30.3 libreoffice-impress-debuginfo-6.1.5.2-30.3 libreoffice-mailmerge-6.1.5.2-30.3 libreoffice-math-6.1.5.2-30.3 libreoffice-math-debuginfo-6.1.5.2-30.3 libreoffice-officebean-6.1.5.2-30.3 libreoffice-officebean-debuginfo-6.1.5.2-30.3 libreoffice-pyuno-6.1.5.2-30.3 libreoffice-pyuno-debuginfo-6.1.5.2-30.3 libreoffice-qt5-6.1.5.2-30.3 libreoffice-qt5-debuginfo-6.1.5.2-30.3 libreoffice-sdk-6.1.5.2-30.3 libreoffice-sdk-debuginfo-6.1.5.2-30.3 libreoffice-sdk-doc-6.1.5.2-30.3 libreoffice-writer-6.1.5.2-30.3 libreoffice-writer-debuginfo-6.1.5.2-30.3 libreoffice-writer-extensions-6.1.5.2-30.3 libreofficekit-6.1.5.2-30.3 libreofficekit-devel-6.1.5.2-30.3 References: https://bugzilla.suse.com/1079744 https://bugzilla.suse.com/1088266 https://bugzilla.suse.com/1095755 https://bugzilla.suse.com/1107012 https://bugzilla.suse.com/1110345 https://bugzilla.suse.com/1110348 https://bugzilla.suse.com/1112112 https://bugzilla.suse.com/1112113 https://bugzilla.suse.com/1112114 https://bugzilla.suse.com/1117195 https://bugzilla.suse.com/1117300 https://bugzilla.suse.com/1124658 https://bugzilla.suse.com/882383

1 0

openSUSE-SU-2019:0323-1: moderate: Security update for libcomps
by opensuse-security＠opensuse.org 11 Mar '19

11 Mar '19

openSUSE Security Update: Security update for libcomps ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0323-1 Rating: moderate References: #1122841 Cross-References: CVE-2019-3817 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libcomps fixes the following issue: Security issue fixed: - CVE-2019-3817: Fixed a use-after-free vulnerability in comps_objmradix.c:comps_objmrtree_unite() function where could allow to application crash or code execution (bsc#1122841). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-323=1 Package List: - openSUSE Leap 15.0 (noarch): libcomps-doc-0.1.8-lp150.2.3.1 python-libcomps-doc-0.1.8-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libcomps-debuginfo-0.1.8-lp150.2.3.1 libcomps-debugsource-0.1.8-lp150.2.3.1 libcomps-devel-0.1.8-lp150.2.3.1 libcomps0_1_6-0.1.8-lp150.2.3.1 libcomps0_1_6-debuginfo-0.1.8-lp150.2.3.1 python2-libcomps-0.1.8-lp150.2.3.1 python2-libcomps-debuginfo-0.1.8-lp150.2.3.1 python3-libcomps-0.1.8-lp150.2.3.1 python3-libcomps-debuginfo-0.1.8-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2019-3817.html https://bugzilla.suse.com/1122841

1 0

openSUSE-SU-2019:0322-1: important: Security update for hiawatha
by opensuse-security＠opensuse.org 09 Mar '19

09 Mar '19

openSUSE Security Update: Security update for hiawatha ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0322-1 Rating: important References: #1125751 Cross-References: CVE-2019-8358 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for hiawatha to version 10.8.4 fixes the following issue: Security issue fixed: - CVE-2019-8358: Fixed a vulnerability which allowed a remote atacker to perform directory traversal when AllowDotFiles was enabled (bsc#1125751). This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-322=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): hiawatha-10.8.4-bp150.3.3.1 hiawatha-letsencrypt-10.8.4-bp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2019-8358.html https://bugzilla.suse.com/1125751

1 0