March 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:1076-1: moderate: Security update for nodejs4
by opensuse-security＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Security Update: Security update for nodejs4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1076-1 Rating: moderate References: #1127080 #1127532 #1127533 Cross-References: CVE-2019-1559 CVE-2019-5737 CVE-2019-5739 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nodejs4 fixes the following issues: Security issues fixed: - CVE-2019-5739: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127533). - CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127532). - CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding Oracle which under certain circumstances a TLS server can be forced to respond differently to a client and lead to the decryption of the data (bsc#1127080). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1076=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): nodejs4-4.9.1-23.1 nodejs4-debuginfo-4.9.1-23.1 nodejs4-debugsource-4.9.1-23.1 nodejs4-devel-4.9.1-23.1 npm4-4.9.1-23.1 - openSUSE Leap 42.3 (noarch): nodejs4-docs-4.9.1-23.1 References: https://www.suse.com/security/cve/CVE-2019-1559.html https://www.suse.com/security/cve/CVE-2019-5737.html https://www.suse.com/security/cve/CVE-2019-5739.html https://bugzilla.suse.com/1127080 https://bugzilla.suse.com/1127532 https://bugzilla.suse.com/1127533

1 0

openSUSE-SU-2019:1075-1: moderate: Security update for libssh2_org
by opensuse-security＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Security Update: Security update for libssh2_org ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1075-1 Rating: moderate References: #1091236 #1128471 #1128472 #1128474 #1128476 #1128480 #1128481 #1128490 #1128492 #1128493 Cross-References: CVE-2019-3855 CVE-2019-3856 CVE-2019-3857 CVE-2019-3858 CVE-2019-3859 CVE-2019-3860 CVE-2019-3861 CVE-2019-3862 CVE-2019-3863 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 9 vulnerabilities and has one errata is now available. Description: This update for libssh2_org fixes the following issues: Security issues fixed: - CVE-2019-3861: Fixed Out-of-bounds reads with specially crafted SSH packets (bsc#1128490). - CVE-2019-3862: Fixed Out-of-bounds memory comparison with specially crafted message channel request packet (bsc#1128492). - CVE-2019-3860: Fixed Out-of-bounds reads with specially crafted SFTP packets (bsc#1128481). - CVE-2019-3863: Fixed an Integer overflow in user authenticate keyboard interactive which could allow out-of-bounds writes with specially crafted keyboard responses (bsc#1128493). - CVE-2019-3856: Fixed a potential Integer overflow in keyboard interactive handling which could allow out-of-bounds write with specially crafted payload (bsc#1128472). - CVE-2019-3859: Fixed Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev (bsc#1128480). - CVE-2019-3855: Fixed a potential Integer overflow in transport read which could allow out-of-bounds write with specially crafted payload (bsc#1128471). - CVE-2019-3858: Fixed a potential zero-byte allocation which could lead to an out-of-bounds read with a specially crafted SFTP packet (bsc#1128476). - CVE-2019-3857: Fixed a potential Integer overflow which could lead to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet (bsc#1128474). Other issue addressed: - Libbssh2 will stop using keys unsupported types in the known_hosts file (bsc#1091236). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1075=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libssh2-1-1.4.3-19.3.1 libssh2-1-debuginfo-1.4.3-19.3.1 libssh2-devel-1.4.3-19.3.1 libssh2_org-debugsource-1.4.3-19.3.1 - openSUSE Leap 42.3 (x86_64): libssh2-1-32bit-1.4.3-19.3.1 libssh2-1-debuginfo-32bit-1.4.3-19.3.1 References: https://www.suse.com/security/cve/CVE-2019-3855.html https://www.suse.com/security/cve/CVE-2019-3856.html https://www.suse.com/security/cve/CVE-2019-3857.html https://www.suse.com/security/cve/CVE-2019-3858.html https://www.suse.com/security/cve/CVE-2019-3859.html https://www.suse.com/security/cve/CVE-2019-3860.html https://www.suse.com/security/cve/CVE-2019-3861.html https://www.suse.com/security/cve/CVE-2019-3862.html https://www.suse.com/security/cve/CVE-2019-3863.html https://bugzilla.suse.com/1091236 https://bugzilla.suse.com/1128471 https://bugzilla.suse.com/1128472 https://bugzilla.suse.com/1128474 https://bugzilla.suse.com/1128476 https://bugzilla.suse.com/1128480 https://bugzilla.suse.com/1128481 https://bugzilla.suse.com/1128490 https://bugzilla.suse.com/1128492 https://bugzilla.suse.com/1128493

1 0

openSUSE-RU-2019:1073-1: moderate: Recommended update for kio-extras5
by maintenance＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Recommended Update: Recommended update for kio-extras5 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1073-1 Rating: moderate References: Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for kio-extras5 fixes the following issues: - Fix to allow write access to Samba Shares' root Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1073=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): kio-extras5-17.04.2-3.3.1 kio-extras5-debuginfo-17.04.2-3.3.1 kio-extras5-debugsource-17.04.2-3.3.1 - openSUSE Leap 42.3 (noarch): kio-extras5-lang-17.04.2-3.3.1 References:

1 0

openSUSE-SU-2019:1066-1: Security update for ffmpeg-4
by opensuse-security＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Security Update: Security update for ffmpeg-4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1066-1 Rating: low References: #1092241 #1100348 #1105869 Cross-References: CVE-2018-13300 CVE-2018-15822 Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for ffmpeg-4 to version 4.0.2 fixes the following issues: These security issues were fixed: - CVE-2018-15822: The flv_write_packet function did not check for an empty audio packet, leading to an assertion failure and DoS (bsc#1105869). - CVE-2018-13300: An improper argument passed to the avpriv_request_sample function may have triggered an out-of-array read while converting a crafted AVI file to MPEG4, leading to a denial of service and possibly an information disclosure (bsc#1100348). These non-security issues were fixed: - Enable webvtt encoders and decoders (boo#1092241). - Build codec2 encoder and decoder, add libcodec2 to enable_decoders and enable_encoders. - Enable mpeg 1 and 2 encoders. This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-1066=1 Package List: - openSUSE Backports SLE-15 (aarch64 ppc64le s390x x86_64): ffmpeg-4-libavcodec-devel-4.0.2-bp150.21.1 ffmpeg-4-libavdevice-devel-4.0.2-bp150.21.1 ffmpeg-4-libavfilter-devel-4.0.2-bp150.21.1 ffmpeg-4-libavformat-devel-4.0.2-bp150.21.1 ffmpeg-4-libavresample-devel-4.0.2-bp150.21.1 ffmpeg-4-libavutil-devel-4.0.2-bp150.21.1 ffmpeg-4-libpostproc-devel-4.0.2-bp150.21.1 ffmpeg-4-libswresample-devel-4.0.2-bp150.21.1 ffmpeg-4-libswscale-devel-4.0.2-bp150.21.1 ffmpeg-4-private-devel-4.0.2-bp150.21.1 libavcodec58-4.0.2-bp150.21.1 libavdevice58-4.0.2-bp150.21.1 libavfilter7-4.0.2-bp150.21.1 libavformat58-4.0.2-bp150.21.1 libavresample4-4.0.2-bp150.21.1 libavutil56-4.0.2-bp150.21.1 libpostproc55-4.0.2-bp150.21.1 libswresample3-4.0.2-bp150.21.1 libswscale5-4.0.2-bp150.21.1 - openSUSE Backports SLE-15 (aarch64_ilp32): libavcodec58-64bit-4.0.2-bp150.21.1 libavdevice58-64bit-4.0.2-bp150.21.1 libavfilter7-64bit-4.0.2-bp150.21.1 libavformat58-64bit-4.0.2-bp150.21.1 libavresample4-64bit-4.0.2-bp150.21.1 libavutil56-64bit-4.0.2-bp150.21.1 libpostproc55-64bit-4.0.2-bp150.21.1 libswresample3-64bit-4.0.2-bp150.21.1 libswscale5-64bit-4.0.2-bp150.21.1 References: https://www.suse.com/security/cve/CVE-2018-13300.html https://www.suse.com/security/cve/CVE-2018-15822.html https://bugzilla.suse.com/1092241 https://bugzilla.suse.com/1100348 https://bugzilla.suse.com/1105869

1 0

openSUSE-SU-2019:1062-1: important: Security update for chromium
by opensuse-security＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1062-1 Rating: important References: #1129059 Cross-References: CVE-2019-5787 CVE-2019-5788 CVE-2019-5789 CVE-2019-5790 CVE-2019-5791 CVE-2019-5792 CVE-2019-5793 CVE-2019-5794 CVE-2019-5795 CVE-2019-5796 CVE-2019-5797 CVE-2019-5798 CVE-2019-5799 CVE-2019-5800 CVE-2019-5801 CVE-2019-5802 CVE-2019-5803 CVE-2019-5804 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: This update for chromium to version 73.0.3683.75 fixes the following issues: Security issues fixed (bsc#1129059): - CVE-2019-5787: Fixed a use after free in Canvas. - CVE-2019-5788: Fixed a use after free in FileAPI. - CVE-2019-5789: Fixed a use after free in WebMIDI. - CVE-2019-5790: Fixed a heap buffer overflow in V8. - CVE-2019-5791: Fixed a type confusion in V8. - CVE-2019-5792: Fixed an integer overflow in PDFium. - CVE-2019-5793: Fixed excessive permissions for private API in Extensions. - CVE-2019-5794: Fixed security UI spoofing. - CVE-2019-5795: Fixed an integer overflow in PDFium. - CVE-2019-5796: Fixed a race condition in Extensions. - CVE-2019-5797: Fixed a race condition in DOMStorage. - CVE-2019-5798: Fixed an out of bounds read in Skia. - CVE-2019-5799: Fixed a CSP bypass with blob URL. - CVE-2019-5800: Fixed a CSP bypass with blob URL. - CVE-2019-5801: Fixed an incorrect Omnibox display on iOS. - CVE-2019-5802: Fixed security UI spoofing. - CVE-2019-5803: Fixed a CSP bypass with Javascript URLs'. - CVE-2019-5804: Fixed a command line injection on Windows. Release notes: https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-des ktop_12.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1062=1 Package List: - openSUSE Leap 15.0 (x86_64): chromedriver-73.0.3683.75-lp150.206.1 chromedriver-debuginfo-73.0.3683.75-lp150.206.1 chromium-73.0.3683.75-lp150.206.1 chromium-debuginfo-73.0.3683.75-lp150.206.1 chromium-debugsource-73.0.3683.75-lp150.206.1 References: https://www.suse.com/security/cve/CVE-2019-5787.html https://www.suse.com/security/cve/CVE-2019-5788.html https://www.suse.com/security/cve/CVE-2019-5789.html https://www.suse.com/security/cve/CVE-2019-5790.html https://www.suse.com/security/cve/CVE-2019-5791.html https://www.suse.com/security/cve/CVE-2019-5792.html https://www.suse.com/security/cve/CVE-2019-5793.html https://www.suse.com/security/cve/CVE-2019-5794.html https://www.suse.com/security/cve/CVE-2019-5795.html https://www.suse.com/security/cve/CVE-2019-5796.html https://www.suse.com/security/cve/CVE-2019-5797.html https://www.suse.com/security/cve/CVE-2019-5798.html https://www.suse.com/security/cve/CVE-2019-5799.html https://www.suse.com/security/cve/CVE-2019-5800.html https://www.suse.com/security/cve/CVE-2019-5801.html https://www.suse.com/security/cve/CVE-2019-5802.html https://www.suse.com/security/cve/CVE-2019-5803.html https://www.suse.com/security/cve/CVE-2019-5804.html https://bugzilla.suse.com/1129059

1 0

openSUSE-RU-2019:1072-1: moderate: Recommended update for LibVNCServer
by maintenance＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Recommended Update: Recommended update for LibVNCServer ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1072-1 Rating: moderate References: #1123805 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for LibVNCServer fixes the following issue: - remmina cannot connect to VNC server (bsc#1123805) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1072=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): LibVNCServer-debugsource-0.9.9-16.12.1 LibVNCServer-devel-0.9.9-16.12.1 libvncclient0-0.9.9-16.12.1 libvncclient0-debuginfo-0.9.9-16.12.1 libvncserver0-0.9.9-16.12.1 libvncserver0-debuginfo-0.9.9-16.12.1 linuxvnc-0.9.9-16.12.1 linuxvnc-debuginfo-0.9.9-16.12.1 References: https://bugzilla.suse.com/1123805

1 0

openSUSE-RU-2019:1068-1: moderate: Recommended update for xorg-x11-server
by maintenance＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Recommended Update: Recommended update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1068-1 Rating: moderate References: #1120999 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xorg-x11-server fixes the following issues: * make sure /var/lib/X11/X still symlinks to /usr/bin/Xorg after migrating from SUSE Linux Enterprise 15 GA (SP0) to SUSE Linux Enterprise 15 SP1 and doing a rollback (bsc#1120999) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1068=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): xorg-x11-server-1.19.6-lp150.7.10.2 xorg-x11-server-debuginfo-1.19.6-lp150.7.10.2 xorg-x11-server-debugsource-1.19.6-lp150.7.10.2 xorg-x11-server-extra-1.19.6-lp150.7.10.2 xorg-x11-server-extra-debuginfo-1.19.6-lp150.7.10.2 xorg-x11-server-sdk-1.19.6-lp150.7.10.2 xorg-x11-server-source-1.19.6-lp150.7.10.2 xorg-x11-server-wayland-1.19.6-lp150.7.10.2 xorg-x11-server-wayland-debuginfo-1.19.6-lp150.7.10.2 References: https://bugzilla.suse.com/1120999

1 0

openSUSE-RU-2019:1063-1: important: Recommended update for apparmor
by maintenance＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Recommended Update: Recommended update for apparmor ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1063-1 Rating: important References: #1123820 #1127073 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for apparmor fixes the following issues: - apparmor prevents libvirtd from starting (bsc#1127073) - Start apparmor after filesystem remount (bsc#1123820) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1063=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): apache2-mod_apparmor-2.12.2-lp150.6.11.2 apache2-mod_apparmor-debuginfo-2.12.2-lp150.6.11.2 apparmor-debugsource-2.12.2-lp150.6.11.2 apparmor-parser-2.12.2-lp150.6.11.2 apparmor-parser-debuginfo-2.12.2-lp150.6.11.2 libapparmor-debugsource-2.12.2-lp150.6.11.2 libapparmor-devel-2.12.2-lp150.6.11.2 libapparmor1-2.12.2-lp150.6.11.2 libapparmor1-debuginfo-2.12.2-lp150.6.11.2 pam_apparmor-2.12.2-lp150.6.11.2 pam_apparmor-debuginfo-2.12.2-lp150.6.11.2 perl-apparmor-2.12.2-lp150.6.11.2 perl-apparmor-debuginfo-2.12.2-lp150.6.11.2 python3-apparmor-2.12.2-lp150.6.11.2 python3-apparmor-debuginfo-2.12.2-lp150.6.11.2 ruby-apparmor-2.12.2-lp150.6.11.2 ruby-apparmor-debuginfo-2.12.2-lp150.6.11.2 - openSUSE Leap 15.0 (x86_64): libapparmor1-32bit-2.12.2-lp150.6.11.2 libapparmor1-32bit-debuginfo-2.12.2-lp150.6.11.2 pam_apparmor-32bit-2.12.2-lp150.6.11.2 pam_apparmor-32bit-debuginfo-2.12.2-lp150.6.11.2 - openSUSE Leap 15.0 (noarch): apparmor-abstractions-2.12.2-lp150.6.11.2 apparmor-docs-2.12.2-lp150.6.11.2 apparmor-parser-lang-2.12.2-lp150.6.11.2 apparmor-profiles-2.12.2-lp150.6.11.2 apparmor-utils-2.12.2-lp150.6.11.2 apparmor-utils-lang-2.12.2-lp150.6.11.2 References: https://bugzilla.suse.com/1123820 https://bugzilla.suse.com/1127073

1 0

openSUSE-RU-2019:1064-1: moderate: Recommended update for LibVNCServer
by maintenance＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Recommended Update: Recommended update for LibVNCServer ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1064-1 Rating: moderate References: #1123805 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for LibVNCServer fixes the following issues: - remmina can not connect to vnc server (bsc#1123805) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1064=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): LibVNCServer-debugsource-0.9.10-lp150.3.10.1 LibVNCServer-devel-0.9.10-lp150.3.10.1 libvncclient0-0.9.10-lp150.3.10.1 libvncclient0-debuginfo-0.9.10-lp150.3.10.1 libvncserver0-0.9.10-lp150.3.10.1 libvncserver0-debuginfo-0.9.10-lp150.3.10.1 References: https://bugzilla.suse.com/1123805

1 0

openSUSE-RU-2019:1069-1: moderate: Recommended update for bc
by maintenance＠opensuse.org 28 Mar '19

28 Mar '19

openSUSE Recommended Update: Recommended update for bc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:1069-1 Rating: moderate References: #1129038 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for bc fixes the following issues: - Correct return value after 'q' command which could lead to problems during Oracle patching (bsc#1129038) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1069=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): bc-1.07.1-lp150.2.3.2 bc-debuginfo-1.07.1-lp150.2.3.2 bc-debugsource-1.07.1-lp150.2.3.2 References: https://bugzilla.suse.com/1129038

1 0